I have an OpenVPN server which authenticates to an Active Directory and asks therefore each user for a username and passphrase.

On top of that it also requires each user to have a client certificate and client key (+ server ca.crt).


I would like that each user must login with their AD username and passphrase and that all clients shares the same client certificate and client key.

The reason I want a shared client certificate and key is for ease of management and it protects the network from someone brute forcing a password.

One way would be to just create one client like so

cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/build-key client1

and give this to each user.

Is that the correct way under these conditions? Or should the client certificate and key be created in a special way?

2 Answers 2


You shouldn't do that, because once your single key is compromised for any reason (stolen laptop, trojan, employee leaving the company, etc.), you will need to give each user a new one, most likely resulting in more time spent than you saved initially by creating only one.

If you want to avoid the complexities of creating a CA and signing (and revoking) client certificates (although with the easy-rsa script it really isn't that hard), OpenVPN also supports static keys (generated with openvpn --genkey) that are very straightforward to handle (although they will also be used for encryption, instead of TLS).

  • 2
    +1 for this. Note also that the client key is an important part of the security of the link. I suspect that if all clients have the same private key, then given the complete ciphertext of one client's session, any other client can decrypt it.
    – MadHatter
    Sep 8, 2011 at 14:05
  • @MadHatter : Only is symmetric key are used I assume?
    – Sandra
    Sep 8, 2011 at 16:57
  • 1
    Sorry, what? The private key and certificate form an asymmetric keypair, the latter being signed by some other entity (hence, certificate). Usually, these are used to negotiate a "nonce" session key, which is a symmetric key, yes. Is that what you meant?
    – MadHatter
    Sep 8, 2011 at 17:02
  • @MadHatter : Sorry about the nonsense I wrote =) But yes, that was what I meant to say =)
    – Sandra
    Sep 8, 2011 at 18:12

First off, I agree with Ingmar Hupp, you don't want to be passing around one single key for a bunch of users. It's really not part of a good security strategy. Additionally, as he mentions, setting up a CA and signing/revoking keys using easy-rsa is quite easy, and IMO worth the additional "manpower" (if you will) to setup / maintain keys properly, instead of passing a single one around.

But anyway, the "technical" answer is to add


to your server.conf file.

  • And you probably want username-as-common-name as well.
    – ysdx
    Jun 15, 2015 at 21:12
  • @ysdx Thank you for this option. Status in openvpn management console now shows real usernames instead of cert name May 21, 2018 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.