Hi, On 27/01/16 17:31, Turnbough, Bradley E. wrote: > Yes. I am aware that an openvpn process can either be a server process, or a > client process. > > I'm wanting to use one ca, cert and key for both tunnels on firewall1 instead > of two different certs. Less mgt overhead.
with your setup that's exactly what you'd get ... the only 'catch' I can think of is that the SSL library does not like to see the same certificate on both ends. If that's the case then you're out of luck. again, without client or server log files it is impossible for us tell what is failing in your setup. HTH, JJK > > ________________________________________ > From: Jan Just Keijser [[email protected]] > Sent: Wednesday, January 27, 2016 9:30 AM > To: Turnbough, Bradley E.; [email protected] > Subject: Re: [Openvpn-users] Same cert for both Client and Server Roles? > > Hi, > > On 27/01/16 15:21, Turnbough, Bradley E. wrote: >> Hi All, >> >> I've got an openvpn server that needs to function as a client for one tunnel >> and a server for another. >> >> I can sign my cert with both "client" and "server" but I cannot make openvpn >> seem to work. >> >> example: >> >> wanfw - (server) ------------(client) - firewall1 - (server) >> ---------------(client) - firewall2 >> >> wangw config: >> tls-server >> ca /etc/openvpn/ca-chain.pem >> cert /etc/openvpn/cert-and-key.pem >> key /etc/openvpn/cert-and-key.pem >> dh /etc/openvpn/dh2048.pem >> >> firewall1 config (for wanfw tunnel): >> tls-client >> tls-remote wanfw >> ca /etc/openvpn/ca-chain.pem >> cert /etc/openvpn/cert-and-key.pem >> key /etc/openvpn/cert-and-key.pem >> dh /etc/openvpn/dh2048.pem >> >> firewall1 config (for firewall2 tunnel): >> tls-server >> ca /etc/openvpn/ca-chain.pem >> cert /etc/openvpn/cert-and-key.pem >> key /etc/openvpn/cert-and-key.pem >> dh /etc/openvpn/dh2048.pem >> > post the output of > openssl x509 -text -noout -in /etc/openvpn/cert-and-key.pem > > so we can tell what is happening with the cert; also, what kind of error > messages are shown in the log? you'd get errors only if you were using > "remote-cert-tls". > > ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140 _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
