Hi all,
On 27/01/16 18:46, Joe Patterson wrote:
Unfortunately, I don't have the output for it, but I recall having the
same problem. Specifically, I had server A accepting clients, but
also acting as a client and connecting to server B (both A and B had
their own unique certs, both with the server attribute). When A
connected to B, B would complain that a server cert was connecting as
a client and drop the session.
IIRC, I solved the issue with 'tls-remote A'/'tls-remote B' and not
including an 'ns-cert-type' entry, but I could be remembering incorrectly.
Actually, scratch that, looking back at some notes, I'm pretty sure I
had to end up using two different certs. So I would be interested to
know if there is a solution I'm not aware of.
I just tested it: yes it is possible to use the same certificate on both
side, BUT
you need to generate the certificate in a non-standard way; by default
the easy-rsa utilities will generate a "clientAuth" (build-key) or
"serverAuth" (build-key-server) certificate. This needs to be overruled
by commenting out 2 lines in openssl-1.0.0.cnf :
191c191
< #extendedKeyUsage=clientAuth
---
> extendedKeyUsage=clientAuth
217c217
< #extendedKeyUsage=serverAuth
---
> extendedKeyUsage=serverAuth
after that you can generate a new certificate that you can use at both ends.
Don't use "remote-cert-tls" and the likes , of course
HTH,
JJK
On Wed, Jan 27, 2016 at 11:41 AM Jan Just Keijser <[email protected]
<mailto:[email protected]>> wrote:
Hi,
On 27/01/16 17:31, Turnbough, Bradley E. wrote:
> Yes. I am aware that an openvpn process can either be a server
process, or a client process.
>
> I'm wanting to use one ca, cert and key for both tunnels on
firewall1 instead of two different certs. Less mgt overhead.
with your setup that's exactly what you'd get ... the only 'catch'
I can
think of is that the SSL library does not like to see the same
certificate on both ends. If that's the case then you're out of luck.
again, without client or server log files it is impossible for us tell
what is failing in your setup.
HTH,
JJK
>
> ________________________________________
> From: Jan Just Keijser [[email protected]
<mailto:[email protected]>]
> Sent: Wednesday, January 27, 2016 9:30 AM
> To: Turnbough, Bradley E.; [email protected]
<mailto:[email protected]>
> Subject: Re: [Openvpn-users] Same cert for both Client and
Server Roles?
>
> Hi,
>
> On 27/01/16 15:21, Turnbough, Bradley E. wrote:
>> Hi All,
>>
>> I've got an openvpn server that needs to function as a client
for one tunnel and a server for another.
>>
>> I can sign my cert with both "client" and "server" but I cannot
make openvpn seem to work.
>>
>> example:
>>
>> wanfw - (server) ------------(client) - firewall1 - (server)
---------------(client) - firewall2
>>
>> wangw config:
>> tls-server
>> ca /etc/openvpn/ca-chain.pem
>> cert /etc/openvpn/cert-and-key.pem
>> key /etc/openvpn/cert-and-key.pem
>> dh /etc/openvpn/dh2048.pem
>>
>> firewall1 config (for wanfw tunnel):
>> tls-client
>> tls-remote wanfw
>> ca /etc/openvpn/ca-chain.pem
>> cert /etc/openvpn/cert-and-key.pem
>> key /etc/openvpn/cert-and-key.pem
>> dh /etc/openvpn/dh2048.pem
>>
>> firewall1 config (for firewall2 tunnel):
>> tls-server
>> ca /etc/openvpn/ca-chain.pem
>> cert /etc/openvpn/cert-and-key.pem
>> key /etc/openvpn/cert-and-key.pem
>> dh /etc/openvpn/dh2048.pem
>>
> post the output of
> openssl x509 -text -noout -in /etc/openvpn/cert-and-key.pem
>
> so we can tell what is happening with the cert; also, what kind
of error
> messages are shown in the log? you'd get errors only if you were
using
> "remote-cert-tls".
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
