is it possible to bind CCD configuration to host certificate in dual factor auth?

ienaxxx

Hi, I set up server with 2 factors auth (username and PW + Host cert).
I enabled remote KERBEROS auth to allow my Active Directory domain users to authenticate in VPN.

I'd like to assign specific IPs (to use specific firewall rules in iptables) and managed to do so via client-config-dir.
Anyway, since usernames are case insensitive in Active directory, so i had to create a lot of files for each user with all the possible combinations (a bash script).
E.g.:
userfc1@domain.ext
Userfc1@domain.ext
uSerfc1@domain.ext
....

So my question is:
Is that possible to bind a configuration to the HOST Certificate instead of the username? I know it is possible when using the USER certificate to login, with the CN of the user, but I can't make it work with Host cert CN.

If not possible: is there a way to workaround this?
Thank You!

TinCanTech

CCD files are bound to the common_name of the certificate.

ienaxxx

Hi TinCanTech.
Unfortunately, I think it's only true when you are using the certificate to authenticate INSTEAD of username and PW.
I tried to create a filename with the common name of the cert. but it simply doesn't work.

Is there anything i should check to verify openvpn is working the correct way?

TiTex

see if --username-as-common-name option does what you want