luis84
Hi everyone,
I am setting up a new OpenVPN network for a small school. I am doing this as a volunteer project as it's a local school but the teachers are not particularly tech friendly, we plan to have 4 OpenVPN servers to connect to and from the different offices.
I have found that I can bundle the configurations in Viscosity to make life easier for them, basically I can just bundle the VPN setup and then they do not have to download config files for each server.
The issue is this, each client on each server has to have it's own .crt and .key. I know that OpenVPN is capable of actually username and password auth only but that would then make it vulnerable to things like "Man in the middle" attacks.
My question: Is it possible to have one master ca.crt for all servers (make all servers use it) and then enable username and password auth and have OpenVPN authenticate with the same ca.crt for all servers and then for secondary auth use the username & password instead of the client crt and key.
Any help would be welcomed, thank you very much!
luis84
Hello,
I have taken a good look over the documentation, it seems to mention that a certificate and key is needed for each client, which is what I thought, I was just hoping there was a way to avoid the need.
I am wondering initially if there is a way to share on CA between multiple servers so all the servers accept the same client key and cert.
ecrist
This is as simple as using identical root CA cert and key on each server.
