getting x509 cert in tls-verify (tls-export-cert)

[beat weisskopf]

Is there any way to get the whole X509 certificate in the tls-verify step? There was once a patch for it (option tls-export-cert), but it seems it did not make it into OpenVPN. Does some other solution exist?

Our usecase: we allow certificates signed from different CAs to login. The verify-cn part can be done easily based on the DN of the certificate. The problem is, they include the CRL and / or OCSP information embedded. We would like to dynamically check the revocation status. The capath option seems of no use, because not all of the auth certifcates include the same CRL (segmented CRLs). There is no one-to-one mapping between CA and CRL.

Thanks for any responses!

[Traffic]

Is there any way to get the whole X509 certificate in the tls-verify step? There was once a patch for it (option tls-export-cert), but it seems it did not make it into OpenVPN.

--tls-verify cmd

• Run command cmd to verify the X509 name of a pending TLS connection

--tls-export-cert directory

• Store the certificates the clients uses upon connection to this directory

See TLS Mode Options in The Manual v23x

[beat weisskopf]

Uh, did no find this via google - should have scanned the man page better.

Thanks a lot,

beat