Client cert do not prompt for password (Windows OpenVPN Server)

armeron

Hello,

I'm new to setting up OpenVPN Server , usually just used OpenVPN on Mikrotik routers. Anyway I needed to do this for someone on a Windows computer.

I found this guide and followed it using the previous version of OpenVPN (with the latest one this guide does not work. Other guides I found online are just clones of this one).

https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide?__cf_chl_jschl_tk__=4d2b4ef9e01bb31e11c08d7e0259c10a215612cf-1613317807-0-Af8hNrb4YWRm_VMTeNOocM-KKlramHlzo8Ph6yiRChxcuDmnED2nmgPzvN26cySdaCukiPEW5QfB9QIPSE3EUlGCl4bT2wna6BMGcuVC_xtaSM2HI5iyTQvZHOh8mTZ-cPRAH-LVK8oVDBB5kHZer6L21JaQfdNx-BxyA27pexBq8OiaSbreurc_k43Tf-qJ_Ws8CRH0j4IHuO_6e3qJ1kMRU1R-tD9UXpW2iB_tK4tjsYbUTREKpEZuTOzT4vHfCezuaczp1SUpJ0meaDw3Y0Tg_veC76uqoh8wLhXfuUahMvT4BuYX6uiYYsiyC_YdL1i8q2Yr_WdDvhh3DsMqsQdQ6SD_Y5oy6Ugk6rs1PTuY

I got everthing working. My concern is that the certificates never prompt the client for a password. Even though I filled passwords in during certificate creation. So if the user's computer gets compromised and someone obtains the OpenVPN files they can connect to the VPN!

How do I get this fixed ? I need some form of additional verification so someone with the files cannot just connect.

TinCanTech

armeron wrote My concern is that the certificates never prompt the client for a password. Even though I filled passwords in during certificate creation.

Then openvpn cannot open those files .. or you did that incorrectly.

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

armeron

Well as I said I can connect to the VPN from a client computer and it works. I followed the guide ( twice , to ensure that I don't miss anything ). It connects no questions asked , which is the problem.

TinCanTech

EasyRSA v2 must create certificates without pass words. Use EasyRSA v3 instead.

You can install EasyRSA v3 from here:
https://github.com/OpenVPN/easy-rsa/releases

armeron

Thanks! I will give that a go