OpenVPN with only certificates, no users pfSense 2.0RC3
-
Yes this part was fine, but where do I create a single user certificate??
and without an user, the client export package doesnt give me the option to export, how do I export the certs??This sounds nice (and huge), i will try it
but as you mentioned, we still need an user account, but i will give a shot -
Hi,
If I create a certificate I use this way:
SYSTEM - Cert Manager
1.) Create a CA
2.) Create a certificate according to my CA
That's all.No I am going to:
SERVICES - OpenVPN - Client Export Utility:
there I Download the "Configuration file" accoridng to the certificate I created before.
No need of a User.Further revoking certificates is working fine. I created two certificates according to one CA. With both I can connect. After this, I revoked one and after a short period of time I could not reconnect anymore with this cert but with the other, which isn't revoked.
I am on HEAD (amd64) built on Wed Jul 6 22:00:09 EDT 2011
-
I really cant export the certs from the Client Export utility without an user
thats the strange thing, very odd -
Same here. No users = no export ability.
-
Hi,
I had a second user in the past when I installed Client Export utility but now there is only the default admin user.
-
This is very strange, whats your pfsense version and package version???
we are missing something -
Read the note at the bottom there. If you can select your VPN from the export list and see no clients to export, you probably did not generate your client certificates from the same CA that the VPN is set to use. Double check the CA selected for the VPN.
-
OK it worked now, what I did was recreate every cert (on cert manager and openvpn) but paying doubled attention to certificates and it showed now
thanks all
-
OK just one problem, for every computer do I need to create a new certificate and a new openvpn server certificate??
-
You only have one server certificate/ca, you have one certificate per user.
-
@TLP:
OK just one problem, for every computer do I need to create a new certificate and a new openvpn server certificate??
1.) You don't need to create an further OpenVPN Server certificate.
2.) You can use the same certificate for different computers BUT then you have to configure this on your server to allow multiple connection from same common name. Further if you revoke a certificate, than alle clients with the same certificate cannot access anymore.
so the the way you should go is:
3.) For every Computer create a new certificate. -
yeah i forgot the user manager ;D
but thats cool, now I got it
thats exactly what i wanted
thanks all (again) ;)
