Hi
I build a new openvpn configuation for my servers and client and have now two questions about the certificate handling of openvpn.
1.)
I use *.p12 files in my config (which include client.crt, client.key and ca.crt).
...
pkcs12 mycert.p12
...
In the Manpage (
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage) I found this:
...
To use TLS mode, each peer that runs OpenVPN should have its own local certificate/key pair ( --cert and --key ), signed by the root certificate which is specified in --ca.
When two OpenVPN peers connect, each presents its local certificate to the other. Each peer will then check that its partner peer presented a certificate which was signed by the master root certificate as specified in --ca.
If that check on both peers succeeds, then the TLS negotiation will succeed, both OpenVPN peers will exchange temporary session keys, and the tunnel will begin passing data.
...
The manpage is not clear in this part.
Do both sides check the certificate of each other against the "ca" if "--ca" option is not used (--ca, --cert, and --key are replaced by --pkcs12)?
...
--pkcs12 file
Specify a PKCS #12 file containing local private key, local certificate, and root CA certificate. This option can be used instead of --ca, --cert, and --key. Not available with PolarSSL.
...
2.)
I don't understand the client warning "no server certificate verification method has been enabled"
What I understand that happens is the following (The sequence does not matter):
- * Client connects to server.
* Client sends the client certificate to the Server.
* Server checks the client certificate against the ca.crt and against the crl list if available
* Server sends the server certificate to the client
* Client checks the Server certificate against the ca.crt and against the crl list if available
* If both sides decide that everithing is ok, then they build up the tunnel
So why should I use an extra option like "--remote-cert-tls server" on the client?
