How to verify serial number of certificate?

thanhtung

I use the 'tls-verify' command to allow only a particular set of certificate CN's:
tls-verify /etc/openvpn/verify-cn
It's ok, but i think it would be nice if we can verify the serial number of a client-certificate, to be more sure that it's the correct certificate. It could be exposed in an environment variable, perhaps? (tls_serial_{n}). I need a example about this.
Please help me? Thanks.

janjust

how would you want to check the serial number?
if the certificate is accepted by OpenVPN then it was signed by a CA cert that OpenVPN trusts - that should be enough.
If you want match against a list of allowed serial numbers then make a list of serial numbers and match ${tls_serial_{n}} against it.

thanhtung

Thanks for quick reply 😃
But i need a example about this. As you asked me, i can use ${tls_serial_{n}}, but i will put it into file config server or into script tls-verify? Please give me an example?

thanhtung

janjust wrotehow would you want to check the serial number?
if the certificate is accepted by OpenVPN then it was signed by a CA cert that OpenVPN trusts - that should be enough.
If you want match against a list of allowed serial numbers then make a list of serial numbers and match ${tls_serial_{n}} against it.

I have get environment variable tls_serial_{0} by type "echo %tls_serial_{0}%" on cmd of Windows, and result is serial number of client's certificate.
I have write a program tls-verify with C and put it into server config :" tls-verify "'C:\\OpenVPNSerialCheck.exe' 123123123", with 123123123 is serial number of client's certificate, and it failed. When i see server.log, message failed is "[ERROR]: Could not find environment variable tls_serial_{0}!"
Please help me, it's best if you can give me a example about it. Thanks.

janjust

I don't have an example for Windows ; the env var you're searching for, however, is

tls_serial_0
tls_serial_1
tls_serial_2

etc. modify your code to look for that variable. Also, run a batch/cmd file and dump the environment as a dummy 'tls-verify' script - you should see the name of the env vars pretty easily.

thanhtung

janjust wroteI don't have an example for Windows ; the env var you're searching for, however, is
tls_serial_0
tls_serial_1
tls_serial_2
etc. modify your code to look for that variable. Also, run a batch/cmd file and dump the environment as a dummy 'tls-verify' script - you should see the name of the env vars pretty easily.

Thank you very much, the env var must be tls_serial_0 as you asked me, this problem resolved.