I've been using Shibby's build of Tomato (64k NVRAM version) on my Asus N66U router in order to run an OpenVPN server.

I'm curious whether it's possible to setup this OpenVPN server to require both a certificate AND a username/password before a user is allowed access.

I noticed there's a "challenge password" entry when filling out the certificate details, but everyone says to leave it blank "or else"; I have no idea why, and I can't find an explanation. In addition, I've Google'd this issue a bunch and have noticed people talking about a PAM module for OpenVPN in order to authenticate via username/password, but that appeared to be an either/or option; in other words, I can force authentication via username/password OR certificate. I want to require both.

Is this possible? If so, how?


The OpenVPN feature you're looking for, which will allow the server to authenticate clients based on both their certificate and a credential, is auth-user-pass-verify. This feature allows the server to pass the username/password provided by the remote user to a script that performs the authentication. At that point you can validate the credentials against anything you want-- PAM, RADIUS, LDAP, smoke signals, etc.

I know nothing about the "Tomato" firmwares so I'm not even going to attempt to give you a step-by-step here. I did some quick searching and I suspect you could use the OpenVPN "Custom Configuration" option to include a auth-user-pass-verify reference. You'll need a script to perform the authentication.

Do some searching and I suspect you'll find "Tomato"-specific references.


The challenge password is a passphrase used to allow decryption of the key. That's the only way you can really do a "password" and a key.

You can really only verify by password or key, not both. If you have both methods enabled, it will try key authentication first, and if that fails, it will fall back to password authentication.

Not having a passphrase on a key makes it easier for someone to mimic your identity if they happen to get a hold of the key.

I'd suggest finding out why the interwebz say you shouldn't use passphrases on keys and see if it's actually a problem.

  • Ya that's what I've been having trouble answering. Hopefully someone else can enlighten us in that regard; it seems like a counterintuitive suggestion. – Eric Aug 23 '12 at 15:24
  • In the meantime, is there a quantifiable way to compare the strength of a certificate+requirement to only a username/password combo? I'm assuming orders of magnitude more difficult to crack, but that's just an assumption based on my circumstantial knowledge. – Eric Aug 23 '12 at 15:35
  • This is an old answer but... That isn't what the challenge password is and does. You can use a passphrase to protect a key, as described above, but the challenge password is something unrelated. It is not stored in either the cert or the key, but is kept with the CA. It is intended to be used when using the CA to revoke the key or issue a replacement. – Jack B Jan 15 at 18:42

auth-user-pass-verify is the right thing todo. In addition you can force auth-user username has to be the certified CN you can also force openvpn to make only one connection each cert at a time.

That way an "mimic" has to have the right user compared to the certc CN and the right pass and he has to logon at a time the real owner doenst

In addition you may think about an IDS, depending which one you choose you can even narrow it down there like allowed external ip ranges, logon times and so on.

Any exposed cert should be revoked immediately. The signing server should be off net - transfer key by usb - then you have a real tight secure access.

and no you should not password a cert.

  1. Easy to bruteforce.
  2. You cannot lock an user (cert pass is offline only).
  3. People loose their passwords all the time forcing you to revoke and recreate a cert everytime - big risk of having a lot of certs out there where you maybe sometimes forget the revoke.

But if you really want you can use auth-user and cert password same time there will be no fallback or something.

First openvpn will use the cert password to decrypt the private key to establish a connection - then auth-user kicks in serversidly - if credentials are wrong you're out.

However if an attacker get the regular credentials you're already in trouble and chances are high he got the cert password too.

So I don't see real benefit here just a lot of downsides and a wrong feeling of more security.


I followed this tutorial (with TomatoUSB Shibby 1.28 on my Asus N66U): http://www.dd-wrt.com/wiki/index.php/OpenVPN This may help you a lot.

  • 2
    AndyZ - welcome to SF, but we like answers here to contain more substance than just a link (which can rot with age). If you can overhaul this answer to contain the important bits of the method you've followed as well as the link to the article, it could be a really good answer. – MadHatter Jan 17 '14 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.