Project

General

Profile

Actions

Feature #11865

open

Option to validate OpenVPN peer TLS certificate key usage

Added by Viktor Gurov 5 months ago. Updated 23 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Category:
OpenVPN
Target version:
Start date:
04/28/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
21.09
Release Notes:
Default

Description

As an additional security measure

https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/:

–remote-cert-tls client|serverRequire that peer certificate was signed with an explicit key usage and extended key usage based on RFC3280 TLS rules.

This is a useful security option for clients, to ensure that the host they connect to is a designated server. Or the other way around; for a server to verify that only hosts with a client certificate can connect.

The –remote-cert-tls client option is equivalent to –remote-cert-ku –remote-cert-eku “TLS Web Client Authentication”

The –remote-cert-tls server option is equivalent to –remote-cert-ku –remote-cert-eku “TLS Web Server Authentication”

This is an important security precaution to protect against a man-in-the-middle attack where an authorized client attempts to connect to another client by impersonating the server. The attack is easily prevented by having clients verify the server certificate using any one of –remote-cert-tls, –verify-x509-name, or –tls-verify.

Actions #2

Updated by Jim Pingle 5 months ago

  • Status changed from New to Pull Request Review
  • Target version set to 2.6.0
Actions #3

Updated by Renato Botelho 3 months ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov
  • Plus Target Version set to 21.09

PR has been merged. Thanks!

Actions #4

Updated by Viktor Gurov 3 months ago

  • % Done changed from 0 to 100
Actions #5

Updated by Jim Pingle 23 days ago

  • Subject changed from Add 'remote-cert-tls client/server' option to Option to validate OpenVPN peer TLS certificate key usage

Updating subject for release notes.

Actions

Also available in: Atom PDF