Authorize Multiple Authorities (CA) in OpenVPN

Question

Desiring to transfer to a new Certificate Authority, I want to allow old clients to connect the VPN for some overlap time. Can I do this without running separate OpenVPN instances?

I see that I can have multiple CA certificates with the capath configuration option. But with that, I still receive an error on the server side:

VERIFY ERROR: depth=0, error=unable to get local issuer certificate:

It seems like in addition to multiple CA certificates, I also need to support multiple server (issuer) certificates, as the extra-certs option doesn't quite work for this. I don't want to sign a single server certificate with two different Certificate Authorities.

How can I support clients with certificates from two different Certificate Authorities in OpenVPN?

Answer 1

client verification

You can link to file ca <file path> in configuration or you can have the cert embedded in <ca></ca> tag directly in the configuration file. In both option there can be more than just one cert (including CA cert).

Normally you have this structure:

-----BEGIN CERTIFICATE-----
... base64 encoded CA cert ...
-----END CERTIFICATE-----

You can easily have two CA certs where one will directly follow the other one:

-----BEGIN CERTIFICATE-----
... base64 encoded CA cert ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... base64 encoded CA cert ...
-----END CERTIFICATE-----

Both will be accepted for the client verification.

server verification

In case you are changing the CA for clients the question would be what about server cert.

• server cert is signed by "third" CA

There is no impact on the server cert so no issue is expected.

• server is signed by the same CA like clients' cert

This may be a little bit tricky as there can be just one certificate for the server. Once you switch to new CA the "old" clients will not see it as trusted. In case you have own CA you can do cross sign (at least temporarily) and "share" this CA cert with the clients using cert option (additional cert like in "client verification" part) so they will see it as trusted cert.

In case you can't do the cross sign or you just simply don't want to do it the "old" clients can still use the own key/cert to authenticate but they have to switch CA cert (cert used to prove the trust of remote side). As the cert can be publicly shared (key have to be kept secure) you can publish the new cert and client can download it even "insecure" way / without VPN connection.