At this link: http://www.felines.org/OpenVPN-Windows_CA-Instructions.htm .. I've posted a first draft of a "How to" document describing a way to use a Windows "Certificate Services" provided Certificate Authority - built-in to Windows Servers, and assuming a Domain context - as the CA for OpenVPN Server and Clients. I'd appreciate feedback and suggestions for improving the document, so that I can get it to a point where it should join the Tutorials. One shortcoming I know in my current method is that, since OpenVPN appears to trust *all* certificates signed by the "root" CA whose certificate is referenced in the OpenVPN Server's config .ovpn file, I really should suggest using an intermediate CA created solely for OpenVPN purposes (unless of course the Domain manager wants anyone who has any certificate issued by his Domain's CA to be able to authenticate to his OpenVPN). It would be quite nice if OpenVPN supported an option to allow only certificates which are both signed by a particular CA and have a particular extension / particular DN element, to avoid this need for an intermediate CA. (OpenVPN authors, what do you think?) Polite and informative comments will be welcomed and thanked. Rude name calling, even if I have indeed made a stupid security error (as it has been a decade since I ran an enterprise Entrust PKI and a bunch of VPN servers), will be ignored, so don't waste your time. Thanks! Jay

Many images on the page do not exist. To give an example: http://www.felines.org/OpenVPN-Windows_CA-Instructions_files/image028.jpg

whats wrong with making an intermediate CA? (or even a different CA all-together than what the rest of the business uses) i will make this sticky I would like to see this make it to tutorials too, people should have options when it comes to how they choose to manage their PKI :mrgreen:

[quote="krzee"]whats wrong with making an intermediate CA? (or even a different CA all-together than what the rest of the business uses) [/quote] I guess you're asking about my request to the OpenVPN authors to give flexibility about which specific certificates issued by a particular CA to trust for OpenVPN client authentication? There's nothing "wrong" with an intermediate CA, for those environments which do not object to the complexity of having an intermediate CA. By the same token, there is nothing wrong with the OpenVPN documentation's recommendation of an off-line master CA, but only very large/ sophisticated organizations do that, again because of the complexity. As far as I can tell, on a Windows Server 2008 (original edition, which is what mine happens to be - I don't know if this has changed on Windows Server 2008R2), you cannot have two CAs on one single server. So there would be an additional server cost to having an intermediate CA. For very small environments, this is a burden, which would not be necessitated by OpenVPN if OpenVPN offered the option to restrict which certificates issued by a particuar CA could be used for OpenVPN authentication to certificates containing a specific DN path (e.g. OU=OpenVPN Authentication) and/or contained a particular certificate purpose extension (not sure if an existing one would do e.g. client authentication, or if that is too-commonly incorrectly included in certificates issued to users). Regarding having an altogether different CA (which is what OpenVPN encourages by default), I do think there is something wrong with that idea. It not only brings complexity, the default OpenSSL self-signed CA requires more infrastructure (distributing the new CA's certificate), and is much less functional than a commercial CA (no CRL distribution point, no certificate auto-re-enrollment at end-of-life) and so is much more likely to be managed insecurely. Please continue with the feedback - let's get this document really useful to people! (And, politely, please do tell me where I've totally %$#%$ed up, because I've surely got something wrong, missed a security nit, or in some other way given bad advice(TM) which should be corrected before this really becomes a tutorial! Thanks!). -Jay

[quote="libove"] By the same token, there is nothing wrong with the OpenVPN documentation's recommendation of an off-line master CA, but only very large/ sophisticated organizations do that, again because of the complexity. [/quote] sophisticated? hell, i do that for my VPNs, it is far from sophisticated to have a weak computer hanging around with no network connection

[quote="libove"] As far as I can tell, on a Windows Server 2008 (original edition, which is what mine happens to be - I don't know if this has changed on Windows Server 2008R2), you cannot have two CAs on one single server. So there would be an additional server cost to having an intermediate CA. [/quote] Sounds like a shortcoming in the windows CA software. [quote="libove"] or contained a particular certificate purpose extension (not sure if an existing one would do e.g. client authentication, or if that is too-commonly incorrectly included in certificates issued to users). [/quote] ns-cert-type client|server or remote-cert-tls client|server [quote="libove"] Regarding having an altogether different CA (which is what OpenVPN encourages by default), I do think there is something wrong with that idea. It not only brings complexity, the default OpenSSL self-signed CA requires more infrastructure (distributing the new CA's certificate), and is much less functional than a commercial CA (no CRL distribution point, no certificate auto-re-enrollment at end-of-life) and so is much more likely to be managed insecurely. [/quote] I do not see how this adds complexity. Yes you must distribute the CA cert, but the CA must also sign and distribute the client's cert, so it adds nothing to hand over the ca cert at the same time. The CRL only needs to be accessed by the server. auto-re-enrollment sounds like it would make something easier to be managed insecurely. [quote="libove"] Please continue with the feedback - let's get this document really useful to people! (And, politely, please do tell me where I've totally %$#%$ed up, because I've surely got something wrong, missed a security nit, or in some other way given bad advice(TM) which should be corrected before this really becomes a tutorial! Thanks!). -Jay[/quote] Right on, and thanks for making a writeup to help people... but since I do not use windows I will not be able to follow along / test stuff.

[quote="libove"] It would be quite nice if OpenVPN supported an option to allow only certificates which are both signed by a particular CA and have a particular extension / particular DN element, to avoid this need for an intermediate CA. (OpenVPN authors, what do you think?) [/quote] I just realized, you CAN do this (and anything else along those lines) with a tls-verify script

Thanks krzee - that's a great pointer! I've spent some hours working on this, and I've been frustrated, as follows: Whether it's a Microsoft thing of an X.509 standard thing I'm not sure, but- 1. the OU fields do not seem to make it in to the actual certificate, so looking for OU="OpenVPN dept" doesn't seem to be possible 2. the CN field length limit, despite a MS document saying it is 64 characters http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x500distinguishedname.aspx, seems to actually be 40 characters (in the Windows 7 MMC Certificates snap-in Request form), and anyway since FQDNs can be at least 63 characters (up to 255 really, I think) we can't make the CN="wkstn.domain.com OpenVPN cert" - we'd too often run out of characters. So, how to get something in to the certificate, without running in to length limits, so that the something can be checked by a tls-verify script on the server? Cheers, Jay p.s. Also flummoxed by how to get whitespace embedded in the path to the tls-verify script in the server.ovpn file on Windows. Whereas "C:\\Program Files\\..." works okay for config file paths, I couldn't find any combination of ", \", "", "\ ", etc, which would survive the openve() or system() call... I keep getting errors about how the program "C:\Program" doesn't exist. I've been testing, in the interim, with the tls-verify script directly in C:\ but that can't stand for production of course. Thanks.

[quote="libove"]Thanks krzee - that's a great pointer! [/quote] you're welcome [quote] 1. the OU fields do not seem to make it in to the actual certificate, so looking for OU="OpenVPN dept" doesn't seem to be possible [/quote] make your script echo out $2 and see what you have to play with [quote] 2. the CN field length limit, despite a MS document saying it is 64 characters ..seems to actually be 40 characters So, how to get something in to the certificate, without running in to length limits, so that the something can be checked by a tls-verify script on the server? [/quote] you dont HAVE to choose such a long naming system... Nothing in the certificate HAS to be the hostname [quote]p.s. Also flummoxed by how to get whitespace embedded in the path to the tls-verify script in the server.ovpn file on Windows. Whereas "C:\\Program Files\\..." works okay for config file paths, I couldn't find any combination of ", \", "", "\ ", etc, which would survive the openve() or system() call... I keep getting errors about how the program "C:\Program" doesn't exist. I've been testing, in the interim, with the tls-verify script directly in C:\ but that can't stand for production of course. Thanks.[/quote] cd "C:\\Program Files\\..." (or "C:/Program Files/...") tls-verify "scriptfile" Hope that helps

draft HOWTO "Use a Windows CA with OpenVPN"

aptoide

https://nextgenapks.com/aptoide-apk-android-ios-iphone-ipad-windows-pc/

So, we will take you through all the details step by step for download aptoide apk and installation guide of aptoide apk along with download link to the apk file of Aptoide.

munawarguru

nice to meet new people and comunity. you are awsome and the people over here are fantastic. thanks for giving me permission in contribution of your shit chat. thanks
Crackeygenerators

technicalonline

assignmenthelpaustralia

Assignment writing requires a vast scope of research about the topic. Our assignment experts select the subject as per their expertise while conducting the project for students who need assignment help, and attempt the writing work with full dedication to provide the unique content.

afancyadmin

I know this is a super old thread, but any chance the linked document still lives someplace?
We have our own CA and all window clients have a valid cert. I just need to see how to make the ovpn file so it uses the local cert and not an embedded one.

aajkinews

Thank you for proving and understanding this method, thanks very much. Additionally, if you want to read short stories such as Bloody Mary Short Story

laocdominoqq

Game dominoqq online uang asli deposit pulsa terpercaya di indonesia yang paling fair no robot serta mudah menang hanya ada di agen paketqq.

oliverthom707

Indeed, the CN isn't required to be the FQDN. So a workaround is to put something other than what I want in there to accomodate technology limitations... but I don't like being limited by technology :-)

oliverthom707

all window clients have a valid cert. I just need to see how to make the ovpn file so it uses the local cert and not an embedded one. - help me out?
teatv.ltd Axis Bank Corporate Login Page

dnkham12

i like your post

tedm

Here ya go:

https://docs.microsoft.com/en-us/windows/wsl/install-win10

Just install as per Microsoft's instructions then generate the CA's under Ubuntu using OpenSSL per the OpenVPN's instructions. As you can see by the above Microsoft has Ubuntu running seamlessly on the desktop.

Wow, Microsoft and Linux, together! Hope nobody's head explodes!
Haven't you heard, they aren't fighting anymore: https://cloudblogs.microsoft.com/windowsserver/2015/05/06/microsoft-loves-linux/

Oh wait, you want to use WINDOWS CA? Well sorry, that's what you get when you try to reanimate zombie threads... ;-) Guess I COULD have posted the instructions to install OpenSSL under Windows instead... :-)

Seriously, why would you want to use a screwdriver to hammer in nails??? Best tool for the job even Microsoft admits to that now.

TinCanTech

tedm wrote Wow, Microsoft and Linux, together! Hope nobody's head explodes!
Haven't you heard, they aren't fighting anymore

Wow .. aviating pork ! -- Naivety is no defence.

You do know that M$ paid Seven Billion Dollars for github.com ?
The dust has not settled yet and most likely never will.

Anyway, why use Microsoft to manage a CA when OpenVPN provide the tools:
https://github.com/OpenVPN/easy-rsa

And additional tools to enhance that:
https://github.com/TinCanTech/easy-tls
https://github.com/TinCanTech/easy-pfp

nothing

TinCanTech wrote Anyway, why use Microsoft to manage a CA when OpenVPN provide the tools:
https://github.com/OpenVPN/easy-rsa

And additional tools to enhance that:
https://github.com/TinCanTech/easy-tls
https://github.com/TinCanTech/easy-pfp

Because there is no better way to manage computers running windows 🙂
With windows CA (and active directory) you have:
* Seamless certificate issue and renewal. The user is not required to do anything to have it's certificate issued and regularly renewed.
* Unexportable certificates - once issued, can't be stolen.

TinCanTech

Why trust Microshaft to do that which you can do better for yourself ?

Remember the Anti-Trust Law Suit ?

Naivety is no defence ..

nothing

I could be wrong...
Please name at least one usable by openvpn alternative where you can issue/renew certificate without having the private key in plain text without an easy way to copy it?

GGHJH

https://bit.ly/3i9uZZ0 obtenir vpn gratuitemenT 100% .INCROYABLE CA MARCHE

GGHJH

https://bit.ly/3i9uZZ0 get vpn for free 100%. AMAZING IT WORKS

kaisehai288

Thank you for this sharing dude. this is very usefully for me 🙂

TinCanTech

Jeroma11 wrote Thank you for this sharing dude. this is very usefully for me 🙂

kaisehai288 wrote Thank you for this sharing dude. this is very usefully for me 🙂

What a waste ..

hazekumar0

thanks - turns out my upload of the document's subsidiary files hadn't completed successfully. That's been fixed now.

« Previous Page Next Page »