Unfortunately, I don't have the output for it, but I recall having the same
problem. Specifically, I had server A accepting clients, but also acting
as a client and connecting to server B (both A and B had their own unique
certs, both with the server attribute). When A connected to B, B would
complain that a server cert was connecting as a client and drop the session.
IIRC, I solved the issue with 'tls-remote A'/'tls-remote B' and not
including an 'ns-cert-type' entry, but I could be remembering incorrectly.
Actually, scratch that, looking back at some notes, I'm pretty sure I had
to end up using two different certs. So I would be interested to know if
there is a solution I'm not aware of.
Thanks,
-Joe
On Wed, Jan 27, 2016 at 11:41 AM Jan Just Keijser <[email protected]> wrote:
> Hi,
>
> On 27/01/16 17:31, Turnbough, Bradley E. wrote:
> > Yes. I am aware that an openvpn process can either be a server process,
> or a client process.
> >
> > I'm wanting to use one ca, cert and key for both tunnels on firewall1
> instead of two different certs. Less mgt overhead.
>
> with your setup that's exactly what you'd get ... the only 'catch' I can
> think of is that the SSL library does not like to see the same
> certificate on both ends. If that's the case then you're out of luck.
>
> again, without client or server log files it is impossible for us tell
> what is failing in your setup.
>
> HTH,
>
> JJK
>
> >
> > ________________________________________
> > From: Jan Just Keijser [[email protected]]
> > Sent: Wednesday, January 27, 2016 9:30 AM
> > To: Turnbough, Bradley E.; [email protected]
> > Subject: Re: [Openvpn-users] Same cert for both Client and Server Roles?
> >
> > Hi,
> >
> > On 27/01/16 15:21, Turnbough, Bradley E. wrote:
> >> Hi All,
> >>
> >> I've got an openvpn server that needs to function as a client for one
> tunnel and a server for another.
> >>
> >> I can sign my cert with both "client" and "server" but I cannot make
> openvpn seem to work.
> >>
> >> example:
> >>
> >> wanfw - (server) ------------(client) - firewall1 - (server)
> ---------------(client) - firewall2
> >>
> >> wangw config:
> >> tls-server
> >> ca /etc/openvpn/ca-chain.pem
> >> cert /etc/openvpn/cert-and-key.pem
> >> key /etc/openvpn/cert-and-key.pem
> >> dh /etc/openvpn/dh2048.pem
> >>
> >> firewall1 config (for wanfw tunnel):
> >> tls-client
> >> tls-remote wanfw
> >> ca /etc/openvpn/ca-chain.pem
> >> cert /etc/openvpn/cert-and-key.pem
> >> key /etc/openvpn/cert-and-key.pem
> >> dh /etc/openvpn/dh2048.pem
> >>
> >> firewall1 config (for firewall2 tunnel):
> >> tls-server
> >> ca /etc/openvpn/ca-chain.pem
> >> cert /etc/openvpn/cert-and-key.pem
> >> key /etc/openvpn/cert-and-key.pem
> >> dh /etc/openvpn/dh2048.pem
> >>
> > post the output of
> > openssl x509 -text -noout -in /etc/openvpn/cert-and-key.pem
> >
> > so we can tell what is happening with the cert; also, what kind of error
> > messages are shown in the log? you'd get errors only if you were using
> > "remote-cert-tls".
> >
> >
>
>
>
> ------------------------------------------------------------------------------
> Site24x7 APM Insight: Get Deep Visibility into Application Performance
> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
> Monitor end-to-end web transactions and take corrective actions now
> Troubleshoot faster and improve end-user experience. Signup Now!
> http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
> _______________________________________________
> Openvpn-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/openvpn-users
>
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
