Score:-1

Server

OpenVPN on ubuntu keeps asking for a CA file

Hikaru Shindo

1/19/24, 4:18 PM

I'm trying to connect to the OpenVPN by using username and password on a Ubuntu 20. The OpenVPN server is working normally because I can connect it on my Macbook.

But When I try to connect it from the Ubuntu, It asks for a CA file but I only have a username and password to connect.

Here is my client.conf,

client
dev tun
remote https://xvpn.myserver.io
auth-user-pass auth.txt

My auth.txt,

myusername
mypassword

I run the VPN by using this command,

sudo openvpn client.conf

And here is the error,

Options error: You must define CA file (--ca) or CA path (--capath) Use --help for more information.

Please help.

*edited I have added (based on https://openvpn.net/community-resources/how-to/#using-username-password-authentication-as-the-only-form-of-client-authentication)

client-cert-not-required
username-as-common-name

to the client.conf But I got below error,

DEPRECATED OPTION: --client-cert-not-required, use --verify-client-cert instead
Options error: --client-cert-not-required and --verify-client-cert require --mode server
Use --help for more information.

990

1 + 3

ubuntu

openvpn

Håkan Lindqvist

1/19/24, 4:31 PM

Probably relevant: https://openvpn.net/community-resources/how-to/#using-username-password-authentication-as-the-only-form-of-client-authentication

Hikaru Shindo

1/19/24, 4:44 PM

I added to the client.conf and go another error, DEPRECATED OPTION: --client-cert-not-required, use --verify-client-cert instead Options error: --client-cert-not-required and --verify-client-cert require --mode server Use --help for more information.

Nikita Kipriyanov

1/20/24, 5:43 AM

the worst OpenVPN configuration is the one which doesn't use certificates for security

Score:1

Server

Tom Cannaerts

1/19/24, 11:39 PM

The CA is not used for user/client verification, but for verifying the server you are connecting to.

You either need to specify the exact CA certificate (using the --ca cli parameter, or ca option in your config file or embed the certificate in the file), or by specifying a path with trusted ca certificates with --capath).

Once the client has verified that it is connecting to a trusted server, it will continue with the auth-user-pass to log in to the server.

So even if you're not using certificates to authenticate yourself, you at least need the CA certificate of the server. You don't need a client certificate and key, just the CA certificate. The VPN server admin will need to provide you with that.

+ 1

Hikaru Shindo

1/23/24, 4:33 AM

But what Windows or Macbook does not ask for the CA file ?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: OpenVPN on ubuntu keeps asking for a CA file

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.