Getting started with OpenVPN. Three windows clients configuration questions: 1) The [b]cryptoapicert[/b] option allows a thumbprint selector (which I've tried, and works), and a "SUBJ"ect selector. Situation: I'd rather not use the Thumbprint since when a certificate expires, I'd have to replace the client config files that reference it . Better to use the subject as a selector. But, I have many certificates with the same name as a subject - from different organizations. They can be distinguished by the other Subject fields: O, OU, etc [b]Question:[/b] How does one specify a [b]subject[/b] so it matches? I have looked at the OpenVPN code, and it calls CertFindCertificateInStore ( ... CERT_FIND_SUBJECT_STR_A ). This wants a substring of CERT_SIMPLE_NAME_STR. And CERT_SIMPLE_NAME_STR says "RDN entries are separated by a comma space" "Multiple attributes are separated by a plus sign space". I can't make this work. Here's a sample Subject: [code]E = john@answers.example.net CN = John Smith OU = Group A OU = Department O = Minicorp L = City S = State C = US [/code] The fields are in the order shown by IE's Certificate display. So I might expect that [code]cryptoapicert "SUBJ:John Smith, Group A, Department, Minicorp"[/code] would match. It doesn't. Or maybe: [code]cryptoapicert "SUBJ:John Smith, Group A, Department+ Minicorp"[/code] (Diff is [b]+[/b] for second OU) It doesn't either. FWIW, openssl sees it as [code]openssl x509 -in john.cer -noout -subject subject= /C=US/ST=State/L=City/O=Minicorp/OU=Group/OU=Department/CN=John Smith/emailAddress=john@answers.example.net[/code] Yes, [code]"SUBJ:John Smith"[/code] matches - but it doesn't help for the case where John has one cert for "O = Minicorp" and another for "0 = OpenVPN newbees".. 2) I would like to specify the CA from the microsoft crypto store. (e.g. [b]cryptoapiCAcert[/b]) - but I don't see such a directive? Did I miss it? If not, I guess this is a feature request. It would prevent having to distribute some certificates twice: Once in the browser, and once in the client OpenVPN config. 3) I have a mix of windows, linux and max clients; some people have more than one. To keep the client configurations simple, I want to put the minimal amount in the client config, and push everything possible from the server. I tried pushing [b]register-dns[/b] unconditionally - this causes an error on Linux clients. I'd rather it be ignored, but 2nd choice is to [b]push register-dns[/b] only to windows clients. I can't really do this based on the client certificate (in a CCD), since John has the same certificate for his notebook and his desktop. [b]Question:[/b] How can I make a push conditional on the client OS? Thanks!!

Windows Config: cryptoapicert and register-dns

tlhackque

Getting started with OpenVPN. Three windows clients configuration questions:

1) The cryptoapicert option allows a thumbprint selector (which I've tried, and works), and a "SUBJ"ect selector. Situation:

I'd rather not use the Thumbprint since when a certificate expires, I'd have to replace the client config files that reference it . Better to use the subject as a selector. But, I have many certificates with the same name as a subject - from different organizations. They can be distinguished by the other Subject fields: O, OU, etc

Question: How does one specify a subject so it matches?

I have looked at the OpenVPN code, and it calls CertFindCertificateInStore ( ... CERT_FIND_SUBJECT_STR_A ). This wants a substring of CERT_SIMPLE_NAME_STR. And CERT_SIMPLE_NAME_STR says "RDN entries are separated by a comma space" "Multiple attributes are separated by a plus sign space". I can't make this work.

Here's a sample Subject:

E = john@answers.example.net
CN = John Smith
OU = Group A
OU = Department
O = Minicorp
L = City
S = State
C = US

The fields are in the order shown by IE's Certificate display. So I might expect that

cryptoapicert "SUBJ:John Smith, Group A, Department, Minicorp"

would match. It doesn't.
Or maybe:

cryptoapicert "SUBJ:John Smith, Group A, Department+ Minicorp"

(Diff is + for second OU) It doesn't either.

FWIW, openssl sees it as

openssl x509 -in john.cer -noout -subject
subject= /C=US/ST=State/L=City/O=Minicorp/OU=Group/OU=Department/CN=John Smith/emailAddress=john@answers.example.net

Yes,

"SUBJ:John Smith"

matches - but it doesn't help for the case where John has one cert for "O = Minicorp" and another for "0 = OpenVPN newbees"..

2) I would like to specify the CA from the microsoft crypto store. (e.g. cryptoapiCAcert) - but I don't see such a directive? Did I miss it? If not, I guess this is a feature request. It would prevent having to distribute some certificates twice: Once in the browser, and once in the client OpenVPN config.

3) I have a mix of windows, linux and max clients; some people have more than one. To keep the client configurations simple, I want to put the minimal amount in the client config, and push everything possible from the server.

I tried pushing register-dns unconditionally - this causes an error on Linux clients. I'd rather it be ignored, but 2nd choice is to push register-dns only to windows clients. I can't really do this based on the client certificate (in a CCD), since John has the same certificate for his notebook and his desktop.

Question: How can I make a push conditional on the client OS?

Thanks!!

tlhackque

More experimentation. # 1 seems to match in the openssl order:

cryptoapicert "SUBJ:US, State, City, Minicorp, Group, Department, John Smith, john@answers.example.net"

I haven't found an example of the '+' delimiter.

This should be documented.

Still hoping for help for #2 and #3

Thanks.

tlhackque

Thank you for the reply.

I understand that register-dns is windows-only. As I wrote, the challenge is that I do not know, a-prioi what os the client is running.
A person may have both a windows and a non-windows certificate, but authenticate with a single token containing his personal ID cert. That certificate in a dual-boot laptop will be Linux one boot, and Windoze the next. A ccd can't solve this.

register-dns causes an error on the client side when pushed to a non-windows client. It would be simpler if it was silently ignored - since what it does is unnecessary on other clients. But no doubt other items will need to be conditionally pushed...

Apparently the OS is pushed to the server if 'push-peer-info' is specified by the server, but does not appear in the connect script environment in released versions of OpenVPN. I understand that feature is in the git master stream, but I'm not there yet. In theory, once that is available (cross-build issues for my server platform), the client-connect script can look and decide what to put in a dynamic client-configuration script.

Yes, I know about the dhcp-option issue - I did read the manual :-) For non-windows I already have a script that not only updates the resolv.conf, it also handles NTP (and shortly, WINS) servers. The foreign_option mechanism is working for me.