0

I want to make custom certificates for OpenVPN without using the username and the password authentication option but rather directly putting the authentication credentials within the client certificate. This will be used for a more flexible authentication system across multiple nodes without the need to create client certificates locally on each node.

Basically, the client certificate will remain the same except for the fact that there is a token inside the certificate itself, and when the client connects to a node. The node will authenticate the client with the token. What is the best way to achieve this without the use of usernames and passwords.

Thank you.

Improve this question
6
  • The best way is still to generate each client its own certificate and distingush them by the CN field. You can embed certificates and keys directly into OpenVPN config file, thus having only one file to configure VPN. And, by the way, without usernames and passwords.
    – Nikita Kipriyanov
    Feb 26, 2021 at 19:10
  • Thank you! How do I add the CN field in the client config.
    – stryz_
    Feb 26, 2021 at 20:33
  • This question demonstrates you didn't tried to read OpenVPN manual. Because this field is the one you can't remove, nothing you need to do to add it. Please, do your homework, at least this: openvpn.net/community-resources/… and it links to the CA management tool: github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md
    – Nikita Kipriyanov
    Feb 27, 2021 at 5:53
  • Yeh, its something cryptographic, but by asking this question I was hoping to get an alternative. Like putting the username and password in the client certificate so that the user will not need to input it. Is there way?
    – stryz_
    Feb 27, 2021 at 22:29
  • Certificate is a public key plus some additional data, all signed by CA. By putting or changing anything in the certificate you change it, so it needs to be signed again. This signing process is no different from just issuing a new certificate with altered data. But, there will be new key pair generated, so each certificate will have its own corresponding private key. Issuing different certificates is the proper way to get several certificates with distinct data inside. Think public and private keys as username and password; put them inside OpenVPN config files so need nothing to enter.
    – Nikita Kipriyanov
    Feb 28, 2021 at 6:37

1 Answer 1

Reset to default
0

This is covered by the OpenVPN manual.

Create for each user a credential file, which is a text file witch just two lines:

username
password

The line separator must be CR or CRLF (e.g. standard Unix or Windows separator). Let's call this file vpn.auth.

Then, add the following line into client config:

...
auth-user-pass vpn.auth
...

If auth-user-pass was already presend, you need to add an argument to it — a filename containing username and password.

For this to work your OpenVPN must be compiled with ENABLE_PASSWORD_SAVE define (which usually is the case). It is also not supported on OpenVPN 3.x (a client-only OpenVPN release), so don't use that version; use OpenVPN community edition 2.5 or later.

Relying on this as a sole authentication mechanism is inherently insecure. This should be implemented only as an additional mechanism. It is not intended to replace the primary asymmetric crypto-based authentication mechanism with personal certificates and private keys, but to enhance it. When planning OpenVPN, you must take as granted the fact it uses personal keys and certificates, and implement your VPN user management so it performs all necessary key generation and signing. If you have some scripts already, you must update them as to include key generation for everyone!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .