Configuring OpenVPN server, I can enable either certificate-based authentication or username/password authentication using
openvpn-plugin-auth-pam plugin, but not both at the same time.
I enable username/password authentication as follows:
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login client-cert-not-required username-as-common-name
But as soon as I add the following lines, my clients configured for certificate authentication stop working with the following messages in the log:
TLS Error: Auth Username/Password was not provided by peer TLS Error: TLS handshake failed
Is there any way to not require username/password from clients that use certificate authentication?