Computer certificate and openvpn without admin

astrakid

Hi,
We are using openvpn with computer certificates, which are refreshed automatically by windows pki
Our openvpn connections are based on these certificates.

Is there a way to start openvpn without admin permissions? Currently our users are local admins which we need to change

Kind regards,
Andre

TinCanTech

Use openvpn 2.4 with the GUI.

astrakid

That's what we do already. But it is not working.
Will check tomorrow for versions and config.

astrakid

so just installed openvpn 2.4.9 to be sure to be on the right version.
using openvpn gui i can open openvpn, but the certificate cannot be extracted from certificate store:

Tue Jul 07 13:16:39 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Tue Jul 07 13:16:39 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Jul 07 13:16:39 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Enter Management Password:
Tue Jul 07 13:16:39 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jul 07 13:16:39 2020 Need hold release from management interface, waiting...
Tue Jul 07 13:16:40 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'state on'
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'log all on'
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'echo all on'
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'bytecount 5'
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'hold off'
Tue Jul 07 13:16:40 2020 MANAGEMENT: CMD 'hold release'
Tue Jul 07 13:16:40 2020 OpenSSL: error:C5066064:microsoft cryptoapi:CryptAcquireCertificatePrivateKey:Der Schlüsselsatz ist nicht vorhanden.
Tue Jul 07 13:16:40 2020 MANAGEMENT: Client disconnected
Tue Jul 07 13:16:40 2020 Cannot load certificate "SUBJ:XXXXXXXX" from Microsoft Certificate Store
Tue Jul 07 13:16:40 2020 Exiting due to fatal error

(XXXXXXXX is my computername)

when starting with administrator privileges it looks like this:

Tue Jul 07 13:21:04 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Tue Jul 07 13:21:04 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Jul 07 13:21:04 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Enter Management Password:
Tue Jul 07 13:21:04 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jul 07 13:21:04 2020 Need hold release from management interface, waiting...
Tue Jul 07 13:21:04 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'state on'
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'log all on'
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'echo all on'
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'bytecount 5'
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'hold off'
Tue Jul 07 13:21:04 2020 MANAGEMENT: CMD 'hold release'
Tue Jul 07 13:21:04 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 07 13:21:04 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 07 13:21:04 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]A.B.C.D:443
Tue Jul 07 13:21:04 2020 Socket Buffers: R=[65536->65536] S=[64512->64512]
Tue Jul 07 13:21:04 2020 Attempting to establish TCP connection with [AF_INET]A.B.C.D:443 [nonblock]
[...]

so how can i solve that?

regards,
andre

TinCanTech

The user needs the cert in their own store, perhaps ?

astrakid

Yes, but Microsoft's mechanisms of refreshing certificates puts the certs in machines cert store.

300000

you need to add certificate p12 into user store so when user login they can use that certificate.

astrakid

300000 wrote you need to add certificate p12 into user store so when user login they can use that certificate.

Can this be done automatically? Currently those certificates are refreshed automatically by windows - if I had to do this manually I have to do it at least once a year per device, which would be a.bad solution.

How do others do this?

Kind regards,
Andre

300000

You need to do it on certificate service to issue a certificate to a user when they login . That certificate need to be setup correctly so they can do automatically. Window certificate is quite good to do that job and should be done but it depends how you setup and manage your server.