I was wondering what will happen if the client erase "ns-cert-type server" in his ovpn config? Will he be vulnerable to man-in-the-middle attack?
yes the client is - in theory - vulnerable to MitM attacks. For such an attack to work, however, the attacker would need to have access to a (client) certificate and private key used by your openvpn setup. If the attacker has these then {s}he can pose as an alternative openvpn server.
Can I use these both together on the client config? Do I only need to specify it at the client config? Or I need to include it too in the server config?
Quote:
remote-cert-tls server
ns-cert-type server
yes you can use them both ; they need to be specified in the client configuration file.
Also, most of the openvpn install instruction I see over the web says keep the "common name" as server when doing build-key-server server?
Which name are they referring to? This one:
Quote:
./build-key-server server
or the common name that is asked after issuing the ./build-key-server command ?
seems like they're referring to that, but the advice is bogus - you can use any name when building the server key using ./build-key-server. It
IS advisable to keep the server common name (the /CN= part of the certificate subject) to something logical/sensible/obvious. I would advise to stick the word 'server' in the name somewhere, but naming your openvpn server "server" is for sissies :lol:
