Hi, On 19/05/15 20:11, Gert Doering wrote: > > On Tue, May 19, 2015 at 07:03:24AM +0400, [email protected] wrote: >> I don't use option "username-as-common-name" but username is equally >> common-name in certificate. >> When both client is connected they by rotation disconnect/reconnect to >> server. > This is expected behaviour. The server can not know that the second > client to connect is not "the first client on a new IP address" but really > a different machines. > > Properly distribute your certificates - *ONE* certificate for *ONE* machine, > not shared between multiple machines, and the problem will go away. > > in theory, it **is** possible to set up a system to allow a certificate to be used only once per connection, and even to connect it to a username, but this is far from trivial. Also, there might be some drawbacks that are not easy to overcome, e.g. roaming users might not be able to maintain their connection.
(for the interested: - add a 'tls-verify' script to check the incoming cert; if the cert is listed in a database/file as "taken" then deny access - add a 'user-auth-verify-pass' script to check the incoming username ; if the user can successfully log on then update the "take-certificate" file with the new entry ) HTH, JJK ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
