I'm using OpenVPN with certificate auth and TLS auth, these are relevant bits from server config:

ca /etc/openvpn/pki/ovpn_tunnel_CA.crt
cert /etc/openvpn/pki/ovpn_tunnel_server.crt
key /etc/openvpn/pki/ovpn_tunnel_server.pem

dh /etc/openvpn/pki/dh2048.pem

tls-auth /etc/openvpn/pki/ovpn_tunnel_tls.key 0 # This file is secret

The server runs 2.4.7-1 on Debian 10 (testing) if it matters.

I have two Linux clients using NetworkManager-openvpn.

On one of them, I used a script to fully re-generate all the certificates, scp them to the server, restart the server, then copy the new CA / server / client cert to where this client would find them, and I was able to connect.

Did not re-generate the TLS auth file.

On another client, I am still able to connect without updating the certificates in NetworkManager's connection properties.

This means the connection on this client still has the "previous" certificates - the old CA cert, the old client cert, the old server cert.

These three certs all "fit" with each other - the old server cert and the old client cert were both issued by the old CA cert.

However they do not match the current CA on the server.

Shouldn't I be getting an auth failure when trying to connect / authenticate with these old certificates?

It worries me that I'm not.

The new certs (on the server) and the old certs (on "second" client) have identical CN, SANs etc. but otherwise they're completely different, unrelated certs, crypto-wise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.