VPNNeeder
Quick security question if you please,
I have a windows client that was installed and configured by logging into my access server (which was configured by IT on a hyperV server). After that original configuration, I want to know how the client authenticates the server if the Root and Intermediate certificates are both on the server. Would the server be a 'self-authenticating entity' in this case?
Perhaps I am getting the VPN authentication confused with website SSL authentication where there is a trusted third party CA?
Please let me know if you need any other details since I don't fully understand this situation.
The Johan
Yeah, you're confusing website SSL authentication with VPN authentication I think.
The website address authentication occurs just like ordinary web browser / web server stuff.
The VPN authentication goes both ways. The server authenticates the client, and the client authenticates the server.
VPNNeeder
Thanks for the quick response,
Would you mind walking me through how the client authenticates the server? The server knows what certificates it has issues, and so knows its clients, but how does the client know?
A brief technical explanation would be appreciated 🙂
The Johan
Um okay, well, how about reading the community documentation on the topic? Here try this for starters:
https://community.openvpn.net/openvpn/wiki/SecurityOverview
VPNNeeder
Thank you,
Yes, I had already read that. Still don't get it.
"In SSL/TLS mode, an SSL session is established with bidirectional authentication (i.e. each side of the connection must present its own certificate)"
How does the server presenting it's own certificate help if the Intermediate certificate is on the Server? So the client asks the server "hey, is this your certificate"? Server says "yes, according to me it is". Self authentication is how i am interpreting that. Does the client have pre-knowledge of the server's certificate so that it doesn't validate the server with the server, but instead with it's own pre-knowledge -as in, something that acts like an Intermediate authority aside from the server?
Thanks for your patience.
The Johan
There are really so many better resources for this out there on the Internet, just look around on Google a bit.
But in short:
On the open Internet with web SSL encryption, you do not have copies of every public key out there, it would be impossible to manage and update. So instead we use the hierarchical properties of SSL certificates. Each certificate knows its direct parent above it with a unique 'fingerprint'. When you visit a website protected with SSL you are offered its public certificate. You follow the trail of parent certificates up until you reach a root authority's certificate or a public certificate already in your certificate store's trusted section. This chain of trust between certificates cannot be faked. Your computer holds a limited list of public keys for a number of trusted root authorities. If you find a match, then the public certificate offered to you by the website you visited, is also automatically trusted and considered the correct server you are expecting to be talking to, and not a fake one. So the server is verified. The client does not need to be verified; anyone is allowed to connect.
With OpenVPN, the private key and public key stuff is transferred over a secure channel (think over an already verified web SSL session, or an SSH session, or with a USB stick or such), and each side will have at least a copy of the other side's public key before the connection starts. So they already know that the public key of the other side is real and trustworthy, and the other side should be able to complete authentication with their private key counterpart. If they can't, they're not the right party you want to talk to. So the server verifies the client, and the client verifies the server, and trust is established in both directions. Not just anyone may connect; only trusted clients may connect.
