Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a openvpn setup on ubuntu that multiple users are connecting to. I want to list all the active certificates with their Common name. Is their a way of doing this ?

share|improve this question
What certificates are 'active' for you? Ones that are used for ("currently") running tunnels or all possible certificates that can initiate tunnels? For the first - write a little connect script that saves all CNs (and remove them on disconnect) - for the latter: ask your PKI. – Michuelnik Sep 6 '12 at 9:08
as an aside, i highly recommend using pfSense for new Openvpn server deployments, so you can take advantage of the awesome certificate management via web UI. pfSense has also come a long way in general, and makes some things that can take literally weeks to configure in PF doable in minutes. (load balanced outbound multiwan for instance). Check out this talk if you are interested in pfSense: – iainlbc Sep 7 '12 at 0:14

You can get a list of current connections to the OpenVPN server either by using the status command over the management interface (see, or by looking at the status file which is specified using the status line in the config files (see

If you want to know who can connect to the OpenVPN server its a bit harder. OpenVPN will let anyone in whose certificate contains a signature generated with the CA key the server is configured to use. If you are using a third party PKI infrastructure they should have records of the certificates they have issued. If you are using the easy-rsa stuff then the certs should all be in that directory.

share|improve this answer

If you're using easy-rsa, check the index.txt file in the keys folder. It should contain a list of all the issued certificates and their subjects (including CN); valid certificates start with a V and revoked ones start with an R.
The current connections are listed in the status file (in my case, openvpn-status.log in the openvpn folder).

share|improve this answer
the index.txt file does not contain a list of issued certificates. Perhaps you have it configured in a way that allows this; if so, please provide the config. – lobi Oct 19 '15 at 15:26
@lobi Well, I looked around and found some openssl-*.cnf files containing database = $dir/index.txt in the [ CA_default ] section. I'm guessing that's where it is specified. It was like that by default, I didn't change anything except the "vars" file. – aditsu Oct 19 '15 at 15:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.