Openvpn client using Subject Alt Names

[krishnamurthydv]

We are using openvpn 2.4.7 version (same on client and server) and we have following requirement.

1. Multiple Clients have to connect to openvpn server using same Certificate
2. Each client should use a unique name from "X509v3 Subject Alternative Name" in the certificate. Basically each client should connect to server using a unique name instead of default common name.

How can this be specified in the client configuration file and passed to the server? How to achieve this? Can you please clarify?

PS: This is similar to using "leftid" in strongswan IKE.

[Gert Döring]

I'm not sure I understand the requirements - so you are using the same certificate, which has like 10 different SANs in, and each client should "send" a different alt name?

This is impossible. There is only one certificate, and the client will send the whole certificate - and there is no signalling "I am really client # 7".

Either use username+password, or individual certificates.

[krishnamurthydv]

Thanks for quick response. For a given client we have a requirement of establishing multiple tunnels to a server from different physical interfaces. So we wanted to use same cert and use SAN (we are doing this in IKE using leftid that is exchanged with the server) - basically to identify the port (at server) on which the request was sent from client.

[Gert Döring]

There is no such mechanism in OpenVPN today - "leftid" compares more to "same cert, different username" in OpenVPN (which would be one possible way to tackle this).