I'm using openvpn (open source version). Each user authenticates using ssl certificates. The problem is that such a certificate can be used on any device. I'd want to restrict the usage of each certificate to only one device.

Is that feasible?

  • Are you trying to prevent users from logging in more than once at a given time (e.g: user has phone and laptop)? Or are you trying to "be secure" and ensure that a given key is used only by the authorized device? IMO, the former is a broken model (each device should have a separate and secret key), and there is no way to ensure the latter. – Attie Mar 11 '20 at 18:16
  • I'm trying the second one you mentioned – sebelk Mar 11 '20 at 18:20
  • I don't believe that is possible. – Attie Mar 11 '20 at 18:27

You need to decide first how to uniquely identify a device in a satisfactory manner (for you, no silver bullet here).

That's the real question. Once you have that, then you can use a post-auth script in openvpn to make use of that information.

Here is the information on post_auth scripts and this is an example of MAC address checking.


It's hardly foolproof, but if you are using TAP you can specify the MAC address in your configuration with:

lladdr=<MAC ADDRESS>

The reference manual has this to say about the option:

–lladdr address

Specify the link layer address, more commonly known as the MAC address. Only applied to TAP devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.