I've setup an OpenVPN server on Debian/jessie, that uses user/password authentication (obtained via LDAP) to grant my users access to the VPN.
The setup deliberately does not use client certificates.
Of course, the server does have a certificate with the hostname
vpn.example.com as the subject.
To initiate the TLS session, the server and the clients share a common
CA, which is used to sign the server's certificate.
Until now, I've setup my own PKI to sign my own server certificates, and shared my own public CA-key with all the clients.
This strikes me as cumbersome, since I will have to hand out a new
CA certificate to all the clients, whenever the certificate expires.
It also requires me to hand out at least two files: the configuration itself and the accompanying certificate, which makes deployment by the users more error prone (as opposed to a simple: "copy this config file into that directory").
Instead, I would like to use some public, well-known PKI (e.g. lets-encrypt/ACME) to sign my server's certificate. Since all the clients already do accept lets-encrypt, this should allow clients to authenticate with only their username/password (and no "token"-like CA-key).
Unfortunately, it seems that OpenVPN requires an explicit
CA-certificate (both on the server and the client side).
Is there a way to make openvpn trust a server certificate if it was signed by some CA that is already trusted system-wide?