I have two OpenVPN Servers...which I foolishly set up with separate CA, CERT, KEY, etc. thus requiring separate client config files. I want to implement failover but am very reluctant to rebuild the second server to make it the same as the first - mainly because they are remote...very remote. So, I've been playing around with the client.conf file on my Raspberry Pi OpenVPN client (Raspbian/Ubuntu) and came across this little tidbit in the OpenVPN manpage: [quote]Certificate authority (CA) file in .pem format, also referred to as the root certificate. [b]This file can have multiple certificates[/b] in .pem format, concatenated together.[/quote] So, with two "remote" lines in my client.conf, I also put two blocks of , , , in that file. And, well, it seems to work. No matter which server I specify first with the "remote" lines, it connects (after restarting openvpn service, of course). I haven't tried failover yet as that would require me taking each remote server off-line individually to test (again reluctant to do so since they are so remote). So, am I fooling myself and this just won't work as a failover client.conf, or have I stumbled onto a lazy solution to my problem?

Your solution is a suitable one, it is called a [i]stacked certificate[/i]. [quote]A stacked certificate means that a bunch of certificates have been stacked together, without any interdependence between them[/quote]Read more here: [url]https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains[/url] Also, you do not need to take a server offline to test fail over .. you can choose which server you want to test by selecting different --[b]remote[/b] .. once you have verified you can connect to both you can use multiple --[b]remote[/b] or in your client config. Details can be found here: [url]https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage[/url]

Could you share your config? Whenever I try to define multiple ca and tls-auth blocks in my config, only the remote with the last defined ca & tls-auth block works. [oconf=Client Config]client dev tun proto tcp remote vpn1.provider.com 443 remote vpn2.provider.com 443 resolv-retry infinite remote-random nobind tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 persist-key persist-tun ping 15 ping-restart 0 ping-timer-rem reneg-sec 0 remote-cert-tls server comp-lzo verb 3 pull fast-io cipher AES-256-CBC route-nopull CA CERT key-direction 1 -----BEGIN OpenVPN Static key V1----- STATIC KEY -----END OpenVPN Static key V1----- [/oconf] Followed by another (the oconf tag seems to strip out the second definitions... Invalid syntax? ) [oconf=Client Config] CA CERT key-direction 1 -----BEGIN OpenVPN Static key V1----- STATIC KEY -----END OpenVPN Static key V1----- [/oconf] If I put my ca and tls-auth concatenated in the same blocks than only the first defined remote works.. I basically want to define about 20 different servers with 20 different ca/tls-auth keys and have openvpn randomly select the server and use the appropriate keys.

Am I fooling myself? Multiple Servers in one client.conf

dahai8

I have two OpenVPN Servers...which I foolishly set up with separate CA, CERT, KEY, etc. thus requiring separate client config files. I want to implement failover but am very reluctant to rebuild the second server to make it the same as the first - mainly because they are remote...very remote.

So, I've been playing around with the client.conf file on my Raspberry Pi OpenVPN client (Raspbian/Ubuntu) and came across this little tidbit in the OpenVPN manpage:

Certificate authority (CA) file in .pem format, also referred to as the root certificate. This file can have multiple certificates in .pem format, concatenated together.

So, with two "remote" lines in my client.conf, I also put two blocks of <ca>, <cert>, <key>, <tls-auth> in that file. And, well, it seems to work. No matter which server I specify first with the "remote" lines, it connects (after restarting openvpn service, of course).

I haven't tried failover yet as that would require me taking each remote server off-line individually to test (again reluctant to do so since they are so remote).

So, am I fooling myself and this just won't work as a failover client.conf, or have I stumbled onto a lazy solution to my problem?

TinCanTech

Your solution is a suitable one, it is called a stacked certificate.

A stacked certificate means that a bunch of certificates have been stacked together, without any interdependence between them

Read more here:
https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains

Also, you do not need to take a server offline to test fail over .. you can choose which server you want to test by selecting different --remote .. once you have verified you can connect to both you can use multiple --remote or <connection blocks> in your client config.

Details can be found here:
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

dahai8

Hot Damn!!!
That makes me SOOOOO happy!
It was such a pain to switch back a forth when one of the servers became unavailable.

dafky2000

Could you share your config? Whenever I try to define multiple ca and tls-auth blocks in my config, only the remote with the last defined ca & tls-auth block works.
client
dev tun
proto tcp

remote vpn1.provider.com 443
remote vpn2.provider.com 443

resolv-retry infinite
remote-random

nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0

remote-cert-tls server

comp-lzo
verb 3
pull
fast-io
cipher AES-256-CBC

route-nopull

<ca>
CA CERT
</ca>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
STATIC KEY
-----END OpenVPN Static key V1-----
</tls-auth> Followed by another (the oconf tag seems to strip out the second definitions... Invalid syntax? )
<ca>
CA CERT
</ca>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
STATIC KEY
-----END OpenVPN Static key V1-----
</tls-auth> If I put my ca and tls-auth concatenated in the same blocks than only the first defined remote works.. I basically want to define about 20 different servers with 20 different ca/tls-auth keys and have openvpn randomly select the server and use the appropriate keys.