OpenVPN

I finally got OpenVPN working with multiple CAs by concatenating the CA
certs into one file and using that with the ca parameter.  Thanks to all
on the list who helped me understand that.

However, does one handle the CRLs the same way? In other words, I will
need CRLs from each of those CAs but there is only one file as an
argument to crl-verify so does one simply concatenate the CRLs from the
different CAs together? Of course, that then implies a manual process
for CRL distribution.  Is there an automated way to retrieve CRLs built
in to OpenVPN or must one do it with third party scripts? Thanks - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@...

If you would like to participate in the development of an open source
enterprise class network security management system, please visit
http://iscs.sourceforge.net

Re: [Openvpn-users] CRLs from multiple CAs From: Alon Bar-Lev <alon.barlev@gm...> - 2006-01-19 18:09 John A. Sullivan III wrote: > I finally got OpenVPN working with multiple CAs by concatenating the CA > certs into one file and using that with the ca parameter. Thanks to all > on the list who helped me understand that. > > However, does one handle the CRLs the same way? In other words, I will > need CRLs from each of those CAs but there is only one file as an > argument to crl-verify so does one simply concatenate the CRLs from the > different CAs together? Of course, that then implies a manual process > for CRL distribution. Is there an automated way to retrieve CRLs built > in to OpenVPN or must one do it with third party scripts? Thanks - John Hello, Have you tried --capath option? It does what you require. But there is a problem, you cannot modify the CRL files while the OpenVPN process is up. I've looked at this issue a while ago, but could not find time to complete. Best Regards, Alon Bar-Lev.

Re: [Openvpn-users] CRLs from multiple CAs From: John A. Sullivan III <jsullivan@op...> - 2006-01-19 18:31 On Thu, 2006-01-19 at 20:08 +0200, Alon Bar-Lev wrote: > John A. Sullivan III wrote: > > I finally got OpenVPN working with multiple CAs by concatenating the CA > > certs into one file and using that with the ca parameter. Thanks to all > > on the list who helped me understand that. > > > > However, does one handle the CRLs the same way? In other words, I will > > need CRLs from each of those CAs but there is only one file as an > > argument to crl-verify so does one simply concatenate the CRLs from the > > different CAs together? Of course, that then implies a manual process > > for CRL distribution. Is there an automated way to retrieve CRLs built > > in to OpenVPN or must one do it with third party scripts? Thanks - John > > Hello, > > Have you tried --capath option? > It does what you require. > But there is a problem, you cannot modify the CRL files > while the OpenVPN process is up. > > I've looked at this issue a while ago, but could not find > time to complete. > > Best Regards, > Alon Bar-Lev. Thanks but I don't see that option in the man pages - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@... Financially sustainable open source development http://www.opensourcedevel.com

Re: [Openvpn-users] CRLs from multiple CAs From: Alon Bar-Lev <alon.barlev@gm...> - 2006-01-19 20:31 John A. Sullivan III wrote: >> Hello, >> >> Have you tried --capath option? >> It does what you require. >> But there is a problem, you cannot modify the CRL files >> while the OpenVPN process is up. >> >> I've looked at this issue a while ago, but could not find >> time to complete. >> >> Best Regards, >> Alon Bar-Lev. > Thanks but I don't see that option in the man pages - John True, but it exists in the 2.1 series... It expects openssl hashed certificate+crl directory. Best Regards, Alon Bar-Lev.

Re: [Openvpn-users] CRLs from multiple CAs From: John A. Sullivan III <jsullivan@op...> - 2006-01-19 20:47 On Thu, 2006-01-19 at 22:24 +0200, Alon Bar-Lev wrote: > John A. Sullivan III wrote: > >> Hello, > >> > >> Have you tried --capath option? > >> It does what you require. > >> But there is a problem, you cannot modify the CRL files > >> while the OpenVPN process is up. > >> > >> I've looked at this issue a while ago, but could not find > >> time to complete. > >> > >> Best Regards, > >> Alon Bar-Lev. > > Thanks but I don't see that option in the man pages - John > > True, but it exists in the 2.1 series... It expects openssl > hashed certificate+crl directory. > <snip> Strange . . . I'm using 2.1 betas 7 and 8. I even searched the online 2.1 man page. Perhaps I'm just brain-cramping. It has been a long couple of days! - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@... If you would like to participate in the development of an open source enterprise class network security management system, please visit http://iscs.sourceforge.net

Re: [Openvpn-users] CRLs from multiple CAs From: Alon Bar-Lev <alon.barlev@gm...> - 2006-01-19 20:55 John A. Sullivan III wrote: > <snip> > Strange . . . I'm using 2.1 betas 7 and 8. I even searched the online > 2.1 man page. Perhaps I'm just brain-cramping. It has been a long > couple of days! - John You are right, it is not documented well... try: # openvpn --help | grep capath --capath dir : A directory of trusted certificates (CAs and CRLs). Alon.

Re: [Openvpn-users] CRLs from multiple CAs From: John A. Sullivan III <jsullivan@op...> - 2006-01-20 22:06 On Thu, 2006-01-19 at 22:54 +0200, Alon Bar-Lev wrote: > John A. Sullivan III wrote: > > <snip> > > Strange . . . I'm using 2.1 betas 7 and 8. I even searched the online > > 2.1 man page. Perhaps I'm just brain-cramping. It has been a long > > couple of days! - John > > You are right, it is not documented well... try: > # openvpn --help | grep capath > --capath dir : A directory of trusted certificates (CAs > and CRLs). <snip> Ah, Ok, now I see it. Why does this create a problem with reading the most current CRL, i.e., changing CRLs without restarting OpenVPN? The how-to on crl-verify states: When the crl-verify option is used in OpenVPN, the CRL file will be re-read any time a new client connects or an existing client renegotiates the SSL/TLS connection (by default once per hour). This means that you can update the CRL file while the OpenVPN server daemon is running, and have the new CRL take effect immediately for newly connecting clients. Is this different when using capath? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@... Financially sustainable open source development http://www.opensourcedevel.com

Re: [Openvpn-users] CRLs from multiple CAs From: Alon Bar-Lev <alon.barlev@gm...> - 2006-01-21 20:25 John A. Sullivan III wrote: > Ah, Ok, now I see it. Why does this create a problem with reading the > most current CRL, i.e., changing CRLs without restarting OpenVPN? > > The how-to on crl-verify states: > When the crl-verify option is used in OpenVPN, the CRL file will be > re-read any time a new client connects or an existing client > renegotiates the SSL/TLS connection (by default once per hour). This > means that you can update the CRL file while the OpenVPN server daemon > is running, and have the new CRL take effect immediately for newly > connecting clients. > > Is this different when using capath? Thanks - John The capath replaces the crl-verify and ca options into default OpenSSL search directory. OpenSSL does not reload the CRL each time it accesses it. This is what yet need to be completed. Best Regards, Alon Bar-Lev.

4 messages have been excluded from this view by a project administrator.