5

I've been trying to get my OVPN server work without client-side certificate verification.

My server.conf contains the following:

# Ports & protocols
port 1194
proto udp
dev tun

# Server certs and keys
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem

# Server subnet
server 198.18.200.0 255.255.255.0

# Persist IP lease pool
ifconfig-pool-persist ipp.txt

# Pushing to a private subnet
 push "route 192.168.10.234 255.255.255.0"

# Allowing duplicate common names for clients (no keys/certs)
duplicate-cn

# KeepAlive
keepalive 10 120

# Cryptographic cipher.
cipher AES-256-CBC

# privilege downgrade fix.
persist-key
persist-tun

# Output a short status log
status openvpn-status.log

# Verbosity level 4
verb 4

# Notify the client that when the server restarts
explicit-exit-notify 1

# Add PAM Auth plugin
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login

# No need for client cert
client-cert-not-required

and the client.conf file contains the following

# Define Client
client

dev tun

# protocol
proto udp-client

# Server
remote abc.efg.xyz

# Service port
port 1194

# Not binding to a specific port
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun


# moderate verbosity
verb 4
mute 10

# Chosen yptographic cipher.
cipher AES-256-CBC

# cipher algorithm
auth SHA1

# Username and password are stored in this file
auth-user-pass f_secret

auth-nocache

I am unable to connect and when I checked the log, it is requiring me the CA file.

Options error: You must define CA file (--ca) or CA path (--capath)

Can someone please tell me, how can I avoid using the CA file?

5
  • 1
    "unable to connect" is not a problem statement.
    – kostix
    Nov 22, 2017 at 13:07
  • What's your problem with the ca file? Is it about having to push an additional file to the client? You could simply embed it to your client config file with modern openvpn versions (iirc since 2.3) Nov 24, 2017 at 5:25
  • Hey! Yes, I really don't want to push additional files to the client. Nov 27, 2017 at 15:03
  • 1
    Any solution? I need same thing, just username and password authentication without any certificate file from client side. May 29, 2019 at 14:21
  • It's actually a HUGE problem, as certificates expires. We do not need OpenVPN certificate based authentication as we use login/password one by RADIUS or OIDC one by openvpn-auth-oauth2 module. Both makes certificate on client side absolutely unnecessary. Problem is that it all works. For some time, maybe 2 years. Then suddenly it all stops working because cert expired. And you have a fun sending your users notice how to update profiles. IT is not show stopper if we post profiles on the same web site which use same OIDC we use for VPN, but it is annoying. We had many cases when system (for exam Mar 7 at 5:05

2 Answers 2

2

You can't skip server certificate verification. Otherwise you would put your users passwords at risk.

Especially when using password authentication, the client needs to verify to whom it is speaking. Otherwise anyone on the network path could impersonate your VPN gateway and steal your users passwords.

5
  • The question was not about server certificate verification.
    – xdfil
    Sep 10, 2018 at 5:01
  • 1
    It was exactly about that. He wanted to skip it (no ca certificate). Sep 10, 2018 at 5:40
  • client side verification
    – xdfil
    Sep 27, 2018 at 17:39
  • 1
    client side verification of the server certificate. Jan 19, 2020 at 15:00
  • 1
    Please help, Why I can connect to VPN just only username and password on my Macbook. But for an Ubuntu, why it keeps asking for a CA ? Jan 19, 2023 at 16:36
0

Maybe you can try using OpenVPN Connect for Windows on the client side. By using this software you can establish connection to vpn server with just username and password. No configuration and certificates required. https://openvpn.net/client-connect-vpn-for-windows/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .