Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a openvpn setup on ubuntu that multiple users are connecting to. I want to list all the active certificates with their Common name. Is their a way of doing this ?

share|improve this question
What certificates are 'active' for you? Ones that are used for ("currently") running tunnels or all possible certificates that can initiate tunnels? For the first - write a little connect script that saves all CNs (and remove them on disconnect) - for the latter: ask your PKI. – Michuelnik Sep 6 '12 at 9:08
as an aside, i highly recommend using pfSense for new Openvpn server deployments, so you can take advantage of the awesome certificate management via web UI. pfSense has also come a long way in general, and makes some things that can take literally weeks to configure in PF doable in minutes. (load balanced outbound multiwan for instance). Check out this talk if you are interested in pfSense: youtube.com/watch?v=ckesvwkNiJE – iainlbc Sep 7 '12 at 0:14

1 Answer

up vote 2 down vote

You can get a list of current connections to the OpenVPN server either by using the status command over the management interface (see http://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html), or by looking at the status file which is specified using the status line in the config files (see http://openvpn.net/index.php/open-source/documentation/howto.html#server).

If you want to know who can connect to the OpenVPN server its a bit harder. OpenVPN will let anyone in whose certificate contains a signature generated with the CA key the server is configured to use. If you are using a third party PKI infrastructure they should have records of the certificates they have issued. If you are using the easy-rsa stuff then the certs should all be in that directory.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.