When I use this on site A: [code]tls-auth ta-hmac.key 0 tls-server ns-cert-type server remote-cert-tls server tls-remote otherserver remote otherserver.demo.tld [/code] I can [b]not[/b] connect. Changing the first 2 lines to [code]tls-auth ta-hmac.key 1 tls-client [/code] makes it work (of course I also changed site B to the opposite in both cases). My site A has a client cert, site B has a server cert. Does it depend on the cert type if tls-server or tls-client must be used? With the first config, the server (site B) spits out this messages: [code]VERIFY ERROR: depth=0, error=unsupported certificate purpose: TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned TLS Error: TLS object -> incoming plaintext read error TLS Error: TLS handshake failed [/code] I'm asking because I currently cannot open the VPN tunnel between site B+C, where both have a server cert. Also, I want my site A (client) to be tls-server, so that it starts the connection. But I seem to only get it running with tls-client...

does tls-server/tls-auth depend on the cert type?

zmi

When I use this on site A:

tls-auth ta-hmac.key 0
tls-server
ns-cert-type server
remote-cert-tls server
tls-remote otherserver
remote otherserver.demo.tld

I can not connect. Changing the first 2 lines to

tls-auth ta-hmac.key 1
tls-client

makes it work (of course I also changed site B to the opposite in both cases). My site A has a client cert, site B has a server cert. Does it depend on the cert type if tls-server or tls-client must be used?

With the first config, the server (site B) spits out this messages:

VERIFY ERROR: depth=0, error=unsupported certificate purpose: <blabla site A cert details>
TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed

I'm asking because I currently cannot open the VPN tunnel between site B+C, where both have a server cert.

Also, I want my site A (client) to be tls-server, so that it starts the connection. But I seem to only get it running with tls-client...

janjust

what exactly are you trying to achieve? in tls mode (i.e. when using certificates) you will always have a client (tls-client) and a server (tls-server); you seem to have set up server certificates, which cannot be used to connect as a client when you use 'remote-cert-tls' or 'ns-cert-type'. you also seem to be using 'tls-auth' with a directional key - this means one end will always need a '0' and the other end a '1' .

zmi

OK, that makes it clear. That information should be on the man page. I'd thought that tls-client and tls-server just assigns the role to both peers, and that it wouldn't depend on the cert type, as you have the other options "ns-cert-type server" and "remote-cert-tls server" for checking the type of the cert. Looks like a piece of grown software, with lots of redundant options which depend on each other. That makes it harder than it needs to. Anyway, it's great software and I am thankful for it. But a bit option polishing and cleanup would be great.

It works now, I generated new certs, all done. Thank you.