pkcs12 and ca config parameters as CLI options

emrehan

Hello everybody,

I'm using openvpn as client with two config files belove.

<pkcs12>
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
</pkcs12>

or

<ca>
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
</ca>

Openvpn version 2.4.11

I use all other option as CLI parameters. I want to use this two as CLI parameters too so I do not need to create config file at all.

I tried --ca --pkcs12 --cert parameters but VPN connection always failed but I can establish VPN with these 2 config file.

Is there any example for these 2 parameters?

Thanks in advance.

TinCanTech

The parameter to a command line option like --ca is /path/to/filename.foo

openvpn_inc

Hi em,

I guess what you want is to do the whole thing in a command line, with none of --config nor --ca nor --cert as separate files? I don't think this is possible. You could perhaps try some bash(1) (or other script language) magic with creating special file descriptors.

You mentioned using two config files. If the goal is to consolidate those into one, sure, you can do that. No point in having inline sections in separate files, just concatenate them into newfile, and call them as:

openvpn --config newfile

regards, rob0

emrehan

Thanks for your answers,

I don't want to use --config file but I can use --ca or --cert or any other one. Currently I could use command line parameter all my configs but <pkcs12> and <ca>.

I use <pkcs12> parameter in config file, OR
I use <ca> parameter if I use smart card.

I actually need format of file which is used with --ca or --cert

TinCanTech

emrehan wrote I actually need format of file which is used with --ca or --cert

PEM.

emrehan

Currently this one works
openvpn.exe --config conf1.ovpn
with this conf

<pkcs12>
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
</pkcs12>

But I want to use it as
openvpn.exe --pkcs12 conf1 OR
openvpn.exe --ca conf1 OR
openvpn.exe --key conf1 OR
openvpn.exe --cert conf1

I tried them all with this file

-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----

Results

Tue Apr 05 11:26:27 2022 MANAGEMENT: CMD 'hold off'
Tue Apr 05 11:26:27 2022 MANAGEMENT: CMD 'hold release'
OPENSSL_Uplink(7BF1A2F0,08): no OPENSSL_Applink

Options error: No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass

Options error: You must define CA file (--ca) or CA path (--capath)

Options error: You must define CA file (--ca) or CA path (--capath)

all failed.

TinCanTech

emrehan wroteBut I want

Doesn't work that way.

emrehan

TinCanTech wrote
emrehan wroteBut I want
Doesn't work that way.

emrehan

Problem not solved.

TinCanTech

Please read the howto.