Re: [Openvpn-users] using tls-remote to verify server

[Nik <openvpn@xxxxxxxxxxxxxxxxxxx>]

Erich Titl schrieb:

> here is more info
>
> if I enter the complete subject line in the config file
>
> tls-remote "/C=CH/L=Schlieren/O=Ruf 
> Telematik/CN=openvpn@xxxxxxxxxxxxxxx/emailAddress=openvpn@xxxxxxxxxxxxxxx"
>
> the following error occurs
>
> Tue Apr 05 15:27:51 2005 VERIFY OK: depth=1, 
> /C=CH/L=Schlieren/O=Ruf_Telematik/OU=ASP/CN=AspCA/emailAddress=ca@xxxxxxxxxx
> Tue Apr 05 15:27:51 2005 VERIFY X509NAME ERROR: 
> /C=CH/L=Schlieren/O=Ruf_Telematik/CN=openvpn@xxxxxxxxxxxxxxx/emailAddress=openvpn@xxxxxxxxxxxxxxx, 
> must be /C=CH/L=Schlieren/O=Ruf 
> Telematik/CN=openvpn@xxxxxxxxxxxxxxx/emailAddress=openvpn@xxxxxxxxxxxxxxx

I came across this as well. Something (openvpn, openssl, etc) changes 
spaces in the X509 name into underscores for the purposes of this 
comparison.

If you look at the error message, you will see that openvpn is trying to 
compare "...Ruf_telematik..."  to "...Ruf Telematik..." (and failing).

So the value you enter for the tls-remote parameter must have all spaces 
changed to underscores.

James said he had added some notes on this to the documentation. I 
didn't actually check what was added, because I had already fixed my 
config files.

> Using
>
> tls-remote "openvpn@xxxxxxxxxxxxxxx"
>
> appears OK
>
> What exactly is the X509 name, the entire subject line does not appear 
> to be right

My understanding is that the X509 name is the entire "subject" such as:

C=xyz/L=abc/O=123/Cn=456/...

The documentation of the tls-remote options says:

"Accept connections only from a host with X509 name or common name equal 
to name."

If I understand it correctly, the X509 name is the entire string, and 
the common name is the value of the CN= part of the X509 name.

The man entry goes on to say: "Name can also be a common name prefix [...]".

So, in your example above, "openvpn@xxxxxxxxxxxxxxx" is being 
successfully matched as a common name prefix. Ie, the string matches the 
beginning of the CN= part of the X509 name of the certificate.

Hope this helps

Cheers!
Nik.

____________________________________________
Openvpn-users mailing list
Openvpn-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/openvpn-users