Hello, Let's assume I have a server that can be used by anyone. My .ovpn file has the and content besides the config. Most VPN providers only add the and to publicly distributed .ovpn files. Is the only reason to avoid double authentication (verify-client-cert none)? (They usually use User/Pass authentication) Or is there a security concern publicly distributing client side the and ? I understand obviously that the server-side secret key should be kept secret. I'm only asking regarding the client .ovpn file. I also understand that there is forward secrecy no matter what. I have been searching for quite a while to understand the privacy-related issues (man in the middle attacks, sniffers reading the VPN traffic)better, but no luck. Thank you in advance for any answers. Best regards, Novun

Question regarding Client Private Keys. Is it safe to share them?

Novun

Hello,

Let's assume I have a server that can be used by anyone. My .ovpn file has the <ca></ca><cert></cert><key></key> and <tls-auth></tls-auth> content besides the config.
Most VPN providers only add the <ca></ca> and <tls-auth></tls-auth> to publicly distributed .ovpn files.

Is the only reason to avoid double authentication (verify-client-cert none)? (They usually use User/Pass authentication)
Or is there a security concern publicly distributing client side the <cert></cert> and <key></key>?

I understand obviously that the server-side secret key should be kept secret. I'm only asking regarding the client .ovpn file.
I also understand that there is forward secrecy no matter what.

I have been searching for quite a while to understand the privacy-related issues (man in the middle attacks, sniffers reading the VPN traffic)better, but no luck.

Thank you in advance for any answers.

Best regards,
Novun