sabakarunner
Hi, forgive me for maybe not understanding how openVPN works.
I am creating an openVPN to act as a backup to our current cisco VPN solution for when it has its 'bad-days' :roll: . We already have certificates issued for everyone in the company. To keep things nice, I want to use the same certificates with open vpn.
For the server, I have
ca.crt
server.key
server.crt
And for a client, I have
ca.crt
client.key
client.crt
I can get an openVPN connection using the easy-rsa scripts and following the HOWTO by generating my own certificates using build-ca, build-key-server and build-key files.
For those of you who don't use this example, the build-key-server generates the server.key and the server.crt.
The build-key script makes the client.crt and client.key.
The build-ca generates the ca.crt file, which is common between the client and server.
Using these generated files, I can make the connection work fine.
However, since I have these files already from our cisco VPN, I simply specified the path to them in the openVPN server.conf and the client.conf files. Ultimately, the handshake keeps failing, and I can't get them to connect.
I looking further into how the certificates were generated in openVPN and the only difference between the build-key-server and the build-key scrips is a '--server" openssl option.
I investigated how our previous certificates were generated and they were all generated using the same script. That means that the current 'server.crt' and 'server.key' files are treated as a client key pair and a link is made between them. Our current cisco VPN handles it just fine.
If I generate two new client client keys using the build-key scripts provided with openVPN and try to create a test link between machines, it fails as well. Openvpn can only create the link if the --server option is specified when generating the server key.
Why can't openVPN make a connection between client certificates? Why does it needs a server and a client certificate? Our ciscoVPN doesn't need that, it is happy creating links between clients.
This also suggests that two openVPN clients could not create a link with each other, only by going through the server, even though they have matching certificates.
I appreciate any feedback on this issue. In the meantime, I am going to hunt down our old scripts for generating certificates and try adding the --server option and see if I can get this working.
???? :? ????
sabakarunner
I solved my own problem...the issue was with the "ns-cert-type server" option in the client configuration. I was not aware you could have a certificate type option and in this case, having a certificate generated with a --server option actually improves security be preventing man-in-the-middle attacks.
Lesson learned: read carefully! :oops:
Next is to figure out if openvpn can read certificates from Microsoft's certificate bank so we only need to keep the certificate in a single location.
