Can “OpenVPN Connect” Windows client be used to connect to a OpenVPN Community server?

akbsol

Hi.

I know its not directly related to the OpenVPN Access Server but not sure where else to place it. As the subject says, is it possible to use "OpenVPN Connect" client (v3 beta currently) for windows to connect to a OpenVPN Community server?

Thanks.

The Johan

Yes it should be supported. However, it is possible that people using an open source server are using configurations that are... how shall I put this politically... "out of the ordinary". A typical example of such a strange issue is when the server is configured not to accept compression from the client, but the client configuration file you load into the client program is forcing compression on. That kind of weird stuff. And in such cases, no matter how good our Connect client software is, it might experience issues. If so you can still report it on our support ticket system and we might be able to help out. The support ticket system is at https://openvpn.net/support

akbsol

novaflash wrote Yes it should be supported. However, it is possible that people using an open source server are using configurations that are... how shall I put this politically... "out of the ordinary". A typical example of such a strange issue is when the server is configured not to accept compression from the client, but the client configuration file you load into the client program is forcing compression on. That kind of weird stuff. And in such cases, no matter how good our Connect client software is, it might experience issues. If so you can still report it on our support ticket system and we might be able to help out. The support ticket system is at https://openvpn.net/support

Thanks for your quick reply. I stumbled across one such configuration which just will not work with "OpenVPN Connect" right away. It has a <ca>..</ca> section but no <key>..</key> and <cert>..</cert> as the auth is done using user/pass combo. Importing such a config file works w/o an error. But when you try to connect, it throws up a error message saying "Missing External Certificate". To overcome this, I copied the content in <ca>..</ca> to notepad and saved it as a PEM file. Then used OpenSSL to convert it to a pfx. Then imported the PFX file in the certificates section of OpenVPN Connect, edited my VPN profile settings and selected it as "Certificate" and saved the settings. Voila!! it works. 🙂

Now I don't understand why should it throw that "Missing External Certificate" error when OpenVPN does allow certificate-less client configurations. And when <ca>..</ca> is already there in the config, why do I have to add the same CA cert in the certificates section and select it in the profile to make it work.

The Johan

I think it's really quite unexpected to be using a ca for certificate verification, and then not use it. I do believe I heard about this case before and that it will be possible (now or in the future) to select 'no certificate' as certificate to use for verification. But yeah, this is really a typical case of a totally weird configuration that just doesn't make sense.

akbsol

novaflash wrote I think it's really quite unexpected to be using a ca for certificate verification, and then not use it. I do believe I heard about this case before and that it will be possible (now or in the future) to select 'no certificate' as certificate to use for verification. But yeah, this is really a typical case of a totally weird configuration that just doesn't make sense.

Is it really that weird a configuration? The <ca>..</ca> in the config I mentioned is meant to verify the server (to prevent MITM) and not the client.

The Johan

Yeah, I think so. In any case, support for it will be added.

akbsol

Your tagline says "I should be on the dev team." but your responses indicate that you already are 🙂

So here is some feedback.. Apart from a 'no certificate' option which will bypass all checks for the remote, I feel OpenVPN Connect should be able to identify the CA in the config file (without cert and key) and store it to validate identity of the remote server. When a CA is already present (<ca>..</ca>) in the config file, one shouldn't have to go through the process of manually putting it in the certificates section of the app.

The Johan

So, openvpn3 always assumes certificates are being used. Add this to your configuration profile to try and override this:
client-cert-not-required
username-as-common-name

And see if you have any luck then?

john_d13

It works but that option is not backward compatible if you are using the v2 openvpn client GUI App. Just an FYI if you want to share universal config with both versions.

Fri Dec 27 14:07:03 2019 DEPRECATED OPTION: --client-cert-not-required, use --verify-client-cert instead
Options error: --client-cert-not-required and --verify-client-cert require --mode server
Use --help for more information.