Open VPN SSL/TLS Peer to Multipeer
-
Hello everyone,
I'm working on a setup using peer to multipeer topology. (1 VPN Server accepting several clients with client certificates) and Client Specific Overrides Control.
i have some questions on the relation between certificates common name, (X.509 common name), Hostname value under certificate attributes while creating the certificate, common name under Client Specific Overrides and the actual hostname of the client.
What is related to what ? Does the client specific override happent based on the certificate common name? Do we have to add the hostname under the certificate attributes, or is not needed ? And finally does the actual client hostname has anything to do with the connection ?
Thanks for any comments.
-
@Bambos said in Open VPN SSL/TLS Peer to Multipeer:
Does the client specific override happent based on the certificate common name?
By default, it does. You can change it to username with "Username as Common Name" in the server settings.
Do we have to add the hostname under the certificate attributes, or is not needed ?
Don't know, where you see this option. But it might not be related to a client certificate anyway.
And finally does the actual client hostname has anything to do with the connection ?
No. The server doesn't see it.
-
@viragomann Thanks a lot for your comments.
username as common name, to my understanding this is for users remote access VPN using per user certificate. .
hostname under certificate attributes, while creating the client certificate.
If we create the certificate with alternative hostname, does this mean that we can use both username and hostname on the settings of Username as common name ?? Not very clear to me, and the documentation is not expanding to this.
-
@Bambos
When stating an alternative hostname, pfSense generates a SAN certificate. There is no reasonable case for me to do this with a user certificate, however.The CSO check verifies only one value, either the common name of the client certificate or the username, not both. As mentioned, which one to use can be set in the server settings.