Mid-session reauth - client certificate change

siskape

Hello,

I am facing one issue with openvpn. As I failed to find answer by myself I am asking here. Please if I overlook something obvious - just point it to me.

I am having problem with session renegotiation hardening which was introduced on 2009.11.12 - Version 2.1_rc21. (http://openvpn.net/index.php/open-source/documentation/change-log/71-21-change-log.html)

The problem is that if openvpn server is running and client's certificate will expire. In order for client to connect again I have to do 2 things:
- renew certificate (ok)
- restart openvpn server (not ok)

If I don't restart the server I start getting error described at
https://community.openvpn.net/openvpn/browser/ssl_verify.c?rev=82f925b60c0f029295975e64d9acabb53c0a5e3c#L166

However I have tried to google how to overcome this problem, but I wasn't successfull.

So my question is if there is a way how to deal with this issue?
It's quite big problem (at least I think so) because our server is handling cca 100 - 200 clients but in the near future it is going to handle 2000> clients. And I think each time client's cert is going to expire and the server needs to be restarted - the restart will cause unnecessary performance spikes.

Version info:
using openvpn 2.3.2-5
on centos 6.4

Thanks

siskape

posting configuration:

Server config

local 192.168.0.111
management 192.168.0.111 7072
port 10195
proto udp
dev tun0
ca /etc/openvpn/certificates/all-openvpn-cacert.pem
cert /etc/openvpn/certificates/XX-openvpn-cert.pem
key /etc/openvpn/certificates/XX-openvpn-key.pem
dh /etc/openvpn/certificates/dh1024.pem
server 10.230.64.0 255.255.224.0
ifconfig-pool-persist ipp.txt
push "route ${SERVER_LAN} 255.255.255.0"
push "dhcp-option DNS ${DOM_DNS}"
push "dhcp-option DOMAIN ${DOM}.local"
client-config-dir ccd
route ${CLIENT_LAN} 255.255.128.0
keepalive 10 120
comp-lzo
max-clients 32766
persist-key
persist-tun
status status.log
log         /var/log/openvpn.log
verb 4
tmp-dir /tmp

Client config

client
dev tun0
proto udp
remote ${SERVER_PUB_IP} 10195
resolv-retry infinite
lport 11195
persist-key
persist-tun
ca "/etc/tbo/all-openvpn-cacert.pem"
cert "/etc/tbo/CLIENT-openvpn-cert.pem"
key "/etc/tbo/CLIENT-openvpn-key.pem"
ns-cert-type server
comp-lzo
verb 4

Regarding the logs - I don't have them right now. But I have pointed the location in code which triggered the log message. I hope the problem description is clearer now.

siskape

Please don't take me wrong but I have a feeling we don't understand each other. Allow me to restate the problem.

The status:

OpenVPN server is working well

clients can connect to server without any problem

Thus normal operation is flawless.

The problem:
As you can see in configuration I've posted, we are using certificate authentication.
Problem occurs once the certificate for client expires.
I generate the new one, replace it on the client and restart the OpenVPN client to take the new certificate (which is actually renewed certificate).
However because of security measure introduced in 2.1_rc21, OpenVPN is now storing hash from whole certificate and will refuse client which during server session changes the certificate. See this code which is triggered in such situation -> https://community.openvpn.net/openvpn/browser/ssl_verify.c?rev=82f925b60c0f029295975e64d9acabb53c0a5e3c#L166

The workaround:
right now I am restarting the server after each certificate change at client side. However I found this as clunky workaround.

The solution:
I am not an OpenVPN developer so this are only suggestion:

provide configuration directive which will control how the OpenVPN will handle the certificate change during server session

provide management console command to reset hash for particular client

Thanks