Common client profile

shar0119

Can a single client (autologin) profile be used to connect to multiple OpenVPN server?

In the .ovpn file, I see ca, cert, key and tls-auth. Can the OpenVPN servers be configured to have all 4 same?

The idea is to provide profile which can fall back to another VPN server if connection to one fails.

mwandelaar

Actually, yes, you can.

And it's well written down in the manpage under the section "<connection>" , please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage for the details.

And yes, you can configure multiple VPN-servers to accept your client-certificates. Just make sure all the servers have the ca-cert from the issuing CA.

shar0119

Finding it really hard to make the ca-cert same for both servers. I copied ca.crt ca.key server.crt server.key
files from one server to another servers in directory /usr/local/openvpn_as/etc/web-ssl

I am guessing the web-ssl is not the same as OpenVPN ca-cert. Is there a command to obtain the file from one server and import into another?

shar0119

In the as.conf file, there are following lines:

# certificates database
certs_db=sqlite:///~/db/certs.db

# user properties DB
user_prop_db=sqlite:///~/db/userprop.db

# configuration DB
config_db=sqlite:///~/db/config.db

I think the stuff is inside these databases. I am going to try to compare and see.

mwandelaar

shar0119 wroteFinding it really hard to make the ca-cert same for both servers. I copied ca.crt ca.key server.crt server.key
files from one server to another servers in directory /usr/local/openvpn_as/etc/web-ssl

I am guessing the web-ssl is not the same as OpenVPN ca-cert. Is there a command to obtain the file from one server and import into another?

You only need to sync the ca.crt between the servers. This is the file the server uses to check if a client is allowed to connect to this specific server, because the client-certificate needs to be issued with this CA.

The server-certificates are verified by the client, with the ca.crt in the client-config. As long as the clients can verify the server-certificates, they don't need to be the same.

(actually you don't want to have the same certificates on the servers: If you have one server compromised, all of your servers are compromised)