I'm curious what is Your opinion on openvpn client crt/key security
In most cases (tutorials), the clients key/crt are generated on the same openvpn server, and no one cares about the future. This is secure, as long as someone gets into the server :)
There are many scenarios of how this can be a thread. I'd like to prevent 'client spoofing' - where privilege person/admin (inside attack) steel user credentials (key/crt) directly from the server, and use them connect as someone else.
I guess, the only way to prevent this:
- Generate key/crt on the server
- Deliver them to client
- Remove key from server (keep crt do You can revoke it)
Drawback: if user ask for key again - Sorry - You don't have it, You need to generate new key/crt pair (and revoke the old one!)
What would You think about that?