OpenVPN CA Configuration Issue

heinz

I am working with a CA hierarchy that looks like this:

CA1 --> CA2 --> CA3a and CA3b

That is, CA1 is self-signed, CA1 signed CA2, CA2 signed both CA3a and CA3b.

The end state that I would like is a server configuration which allows clients with certs signed by CA3a, but NOT clients with certs signed by CA3b.

When I put the entire CA1 --> CA2 --> CA3a chain into the file pointed at by the 'ca' option on the server side, clients signed by CA3b are able to log in. When I only put CA3a into the file pointed at by the 'ca' option on the server side, no clients can get in, and the server reports a VERIFY ERROR, complaining about the fact that CA1 is self-signed (with the client presenting the entire cert chain). What am I missing? How do I configure this to get the functionality I am looking for?

I am working on an Amazon Linux machine (CentOS/RedHat). I have tried simply appending the CA1 cert file to the end of /etc/pki/tls/certs/ca-bundle.crt, thinking that this would tell the OS to trust CA1, but no luck.

Any advice is appreciated. Thanks!

heinz

Believe me, I've read that over several times. Unfortunately, it doesn't go into enough detail to cover the needs of my specific issue.

heinz

For anyone who may read this looking for an answer to a similar problem, I ended up writing a script to work with the tls-verify flag. It just checks Common Names to make sure the depth=1 CA is in fact CA3a. It is not ideal, but it should suffice for my purposes.

brendan

you have to draw out the trust relationships in oocalc or somehing. the relationship is hierarchial or parent/child in nature.

CA1
|
CA2
|    |
CA3a CA3b

since CA2 signed both CA3a and CA3b, they have a common trust path and therefore will be cross honored by services that use either the a or b CA3 certs. there is no getting around the fact that you need to break the common trust path apart to isolate the a from the b, to avoid the cross honoring.