OpenVPN Support Forum

Hi,

Is it possible to do certificate authentication with clients certificate and the server authenticates the clients certificate with LDAP/AD? I mean that all clients certificate is located on LDAP/AD, not as files inside OpenVPN server. So, it is like standard LDAP/AD authentication without using any password but clients certificate. If it is possible, please inform some configuration example related to this case.

Best regards,

there is no need to store ANY client certificates on the openvpn server; the openvpn server only needs a server certificate+private key , plus the CA cert to authenticate itself.

A good security measure is to NOT store any client keys (and certainly not the CA private key) on the openvpn server itself.

So yes, you can use LDAP/AD to do authentication but it would require some scripting.

Hi,

Any configuration example about using LDAP/AD for authenticating clients certificate?

Best regards,

don't know of any examples; perhaps eurephia comes closest.