brrrknee
Reviewing the means to create the pkcs12 file for an android client
Both the descriptions in openVPN docs and in the openssl pkcs12 manpage aren't clear of how to -if we can at all -pack into the created file the tls-auth ta.key.
Each openssl parm for the create (-export) appears to be singular, not allowing multiple keys.
Openssl does reference that the -in file can have multiple certificates, but not multiple keys.
Does this require the embed-in-ovpn file solution, where all cert/key content is pasted into ovpn xml-like tagged?
If so, does the key-direction 1 still belong in the ovpn, and the cert/keys appended into a separate file for openssl pkcs12 consumption?
brrrknee
new droid OpenVPN Connect explicitly asks for PKCS12 files, whereas the 2.4 OpenVPN docs to date show PolarSSL as not supporting, yet Connect uses PolarSSL and asks for it...
since PKCS12 holds only the 2, and cannot apparently hold anything else, it's clear I need to back away from the implied need to have tls-auth added as a DoS prevention. I'm removing it from server/clients and will test that approach.
