OpenVPN Linux Client - remote-random with verify-x509-name

nbnamp

Hello,
Is there a way to configure OpenVPN Linux Client with multiple remote servers - remote-random with verify-x509-name

Here is my current setup:

client
remote-random
<connection>
remote ABC1.Server.com 1194
</connection>
<connection>
remote ABC2.Server.com 1194
</connection>
<connection>
remote XYZ1.Server.com 1194
</connection>
<connection>
remote XYZ3.Server.com 1194
</connection>

resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
verify-x509-name Server.com name-prefix

with the above conf. I am getting this error:
VERIFY X509NAME ERROR: CN= ABC2.Server.com, must be Server.com

How do I force verify-x509-name to match the randomly selected remote server? is this possible ? If not, are there any other options to get this to work?

Thanks
Nba

TinCanTech

The option 'name-prefix' means that it matches a prefix not a suffix.

nbnamp

Thanks. Is there away to get this to work?

TinCanTech

You could rename all your servers ..

nbnamp

I wish I can.. they aren’t my servers. Any other suggestions?
Thanks

TinCanTech

You could make a Feature Request ..

300000

L2TP use verify-x509-name many year ago but now people start to use it on openvpn that is why l2tp at first make very hard to create a connection but as soon as people understand how verify-x509-name on common name work it more easy to create a connection and now ikev2 and sstp they do the same thing.

in order certificate to connect to multi host name its certificate must use subject alt name so it can connect . in your matter you need to ask person who create a certificate for your client need to create a new certificate with entry subjectAltName contain in certificate which have all of the hostname you want to connect. just copy subjectAltName and add the host name and create news certificate for you . it is more easy if they can do it on windows system. you can research more info with keyword "Multiple SAN Fields Using OpenSSL" and deal with that . i have done it and it work beauty so nothing it cant do but take time to make it work.

if you know how to add this into openssl config and create a certificate with subjectAltName .

[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 =ABC1.Server.com
DNS.2 = ABC2.Server.com
DNS.3 = XYZ1.Server.com

TinCanTech

300000 wrote [ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 =ABC1.Server.com
DNS.2 = ABC2.Server.com
DNS.3 = XYZ1.Server.com

TinCanTech wrote The option 'name-prefix' means that it matches a pre-fix not a suf-fix.

nbnamp wrote

verify-x509-name Server.com name-prefix

I am getting this error:
VERIFY X509NAME ERROR: CN= ABC2.Server.com, must be Server.com

This means:

VERIFY X509NAME ERROR: CN= ABC2.Server.com, must be Server.com* (With a wildcard)

The name must begin Server.com......foo

nbnamp

The problem is that I don’t have access to those servers and I believe the vendor won’t create this type of cert. 🙂
I’m now looking at writing a script to pick a random server, update the client conf. And restart openvpn. Repeat every x hours...
Running out of ideas...
Thanks

300000

TinCanTech wrote
300000 wrote [ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 =ABC1.Server.com
DNS.2 = ABC2.Server.com
DNS.3 = XYZ1.Server.com
TinCanTech wrote The option 'name-prefix' means that it matches a pre-fix not a suf-fix.
nbnamp wrote
verify-x509-name Server.com name-prefix
I am getting this error:
VERIFY X509NAME ERROR: CN= ABC2.Server.com, must be Server.com
This means:
VERIFY X509NAME ERROR: CN= ABC2.Server.com, must be Server.com* (With a wildcard)
The name must begin Server.com......foo

that is why certificate will have subjectAltName to deal with situation on many difference common name . when client certificate have subjectAltName it can connect to many difference host name with many difference certificate common name..

the way easyRSA create certificate dont contain subjectAltName so using that will never work .

this is why it is perfect to have subjectAltName to make it work

TinCanTech

@300000

Your example above is still incorrect ..

'name-prefix'

And, we have not even begun to scratch the surface yet ..