krzee wrotewhats wrong with making an intermediate CA?
(or even a different CA all-together than what the rest of the business uses)
I guess you're asking about my request to the OpenVPN authors to give flexibility about which specific certificates issued by a particular CA to trust for OpenVPN client authentication?
There's nothing "wrong" with an intermediate CA, for those environments which do not object to the complexity of having an intermediate CA. By the same token, there is nothing wrong with the OpenVPN documentation's recommendation of an off-line master CA, but only very large/ sophisticated organizations do that, again because of the complexity.
As far as I can tell, on a Windows Server 2008 (original edition, which is what mine happens to be - I don't know if this has changed on Windows Server 2008R2), you cannot have two CAs on one single server. So there would be an additional server cost to having an intermediate CA.
For very small environments, this is a burden, which would not be necessitated by OpenVPN if OpenVPN offered the option to restrict which certificates issued by a particuar CA could be used for OpenVPN authentication to certificates containing a specific DN path (e.g. OU=OpenVPN Authentication) and/or contained a particular certificate purpose extension (not sure if an existing one would do e.g. client authentication, or if that is too-commonly incorrectly included in certificates issued to users).
Regarding having an altogether different CA (which is what OpenVPN encourages by default), I do think there is something wrong with that idea. It not only brings complexity, the default OpenSSL self-signed CA requires more infrastructure (distributing the new CA's certificate), and is much less functional than a commercial CA (no CRL distribution point, no certificate auto-re-enrollment at end-of-life) and so is much more likely to be managed insecurely.
Please continue with the feedback - let's get this document really useful to people!
(And, politely, please do tell me where I've totally %$#%$ed up, because I've surely got something wrong, missed a security nit, or in some other way given bad advice(TM) which should be corrected before this really becomes a tutorial! Thanks!).
-Jay
