0

I have an OpenVPN server which authenticates to an Active Directory and asks therefore each user for a username and passphrase.

On top of that it also requires each user to have a client certificate and client key (+ server ca.crt).

Question

I would like that each user must login with their AD username and passphrase and that all clients shares the same client certificate and client key.

The reason I want a shared client certificate and key is for ease of management and it protects the network from someone brute forcing a password.

One way would be to just create one client like so

cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/build-key client1

and give this to each user.

Is that the correct way under these conditions? Or should the client certificate and key be created in a special way?

2 Answers 2

4

You shouldn't do that, because once your single key is compromised for any reason (stolen laptop, trojan, employee leaving the company, etc.), you will need to give each user a new one, most likely resulting in more time spent than you saved initially by creating only one.

If you want to avoid the complexities of creating a CA and signing (and revoking) client certificates (although with the easy-rsa script it really isn't that hard), OpenVPN also supports static keys (generated with openvpn --genkey) that are very straightforward to handle (although they will also be used for encryption, instead of TLS).

4
  • 2
    +1 for this. Note also that the client key is an important part of the security of the link. I suspect that if all clients have the same private key, then given the complete ciphertext of one client's session, any other client can decrypt it.
    – MadHatter
    Sep 8, 2011 at 14:05
  • @MadHatter : Only is symmetric key are used I assume?
    – Sandra
    Sep 8, 2011 at 16:57
  • 1
    Sorry, what? The private key and certificate form an asymmetric keypair, the latter being signed by some other entity (hence, certificate). Usually, these are used to negotiate a "nonce" session key, which is a symmetric key, yes. Is that what you meant?
    – MadHatter
    Sep 8, 2011 at 17:02
  • @MadHatter : Sorry about the nonsense I wrote =) But yes, that was what I meant to say =)
    – Sandra
    Sep 8, 2011 at 18:12
8

First off, I agree with Ingmar Hupp, you don't want to be passing around one single key for a bunch of users. It's really not part of a good security strategy. Additionally, as he mentions, setting up a CA and signing/revoking keys using easy-rsa is quite easy, and IMO worth the additional "manpower" (if you will) to setup / maintain keys properly, instead of passing a single one around.

But anyway, the "technical" answer is to add

duplicate-cn

to your server.conf file.

2
  • And you probably want username-as-common-name as well.
    – ysdx
    Jun 15, 2015 at 21:12
  • @ysdx Thank you for this option. Status in openvpn management console now shows real usernames instead of cert name
    – Ross
    May 21, 2018 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .