Создал openvpn-сервер с минимальной защитой, чтобы микротики на него цеплять. Создаю подключение в микротике, без всяких сертификатов спокойно цепляется. То же самое делаю в винде - а она только с ca.crt хочет. Проблем нет, но сама загадка интересна.
конфиг сервера:
## GENERAL ##
# TCP or UDP, port 443, tunneling
mode server
proto tcp
port 11194
dev tun
## KEY, CERTS AND NETWORK CONFIGURATION ##
# Identity
ca ca.crt
# Public key
cert server.crt
# Private key
key server.key
# Symmetric encryption
dh dh.pem
# Encryption protocol
cipher AES-256-CBC
## Network ##
server 10.8.0.0 255.255.0.0
topology subnet
# Allow client to client traffic
client-to-client
# Add route to client-to-client function
push "route 10.8.0.0 255.255.255.0"
# Ping every 10 seconds and if after 120 seconds the client doesn't respond we disconnect
keepalive 10 120
# Regenerate key each 5 hours (disconnect the client)
reneg-sec 18000
## SECURITY ##
# Downgrade privileges of the daemon
user nobody
group nogroup
# Persist keys (because we are nobody, so we couldn't read them again)
persist-key
# Don't close and re open TUN/TAP device
persist-tun
# Enable compression
## LOG ##
# Verbosity
# 3/4 for a normal utilisation
verb 3
# Max 20 messages of the same category
mute 20
# Log gile where we put the clients status
status openvpn-status.log
# Log file
log-append /var/log/openvpn.log
# Configuration directory of the clients
client-config-dir ccd
## PASS ##
# Allow running external scripts with password in ENV variables
script-security 3
# Use the authenticated username as the common name, rather than the common name from the client cert
username-as-common-name
# Client certificate is not required
#verify-client-cert none
client-cert-not-required
# Use the connection script when a user wants to login
auth-user-pass-verify scripts/login.sh via-env
# Maximum of clients
max-clients 1000
# Run this scripts when the client connects/disconnects
client-connect scripts/connect.sh
client-disconnect scripts/disconnect.sh
мусор вырезал, комментарии оставил
