We have OpenVPN clients with CA-Certificates from an old and a new authority.

We can't change them all at once.

The clients are verifying the certificate presented by the server.

Is it possible to sign the server certificate with the old and new CA? Is there another way that both old and new clients can connect?


There is a very similar question at StackOverflow and instruction about how to use multiple CAs (stacked certificates).

Another way is to run two OpenVPN instances on the same host, providing them with different ports and certificates signed by different CAs.

  • Merlin, thank you for your reply. This is what I was looking for. I can't use stacked certificates because then I would have to modify all client CA-files. I'll use two OpenVPN instances. – chris Nov 18 '14 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.