Changes between Version 8 and Version 9 of Openvpn24ManPage

Timestamp:

03/22/17 14:25:45 (7 years ago)

Author:

Samuli Seppänen

Comment:

Update Openvpn24ManPage to OpenVPN 2.4.1

Openvpn24ManPage

@@ -342 +342 @@
 persist-tun
 pkcs12 client.p12
-ns-cert-type server
+remote-cert-tls server
 verb 3
 </B></PRE>
@@ -3340 +3340 @@
 process.
 <P>
+The
+<B>module-pathname</B>
+
+argument can be just a filename or a filename with a relative
+or absolute path.  The format of the filename and path defines
+if the plug-in will be loaded from a default plug-in directory
+or outside this directory.
+<P>
+<PRE>
+<B>--plugin path&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Effective directory used</B>
+====================================================
+ myplug.so            DEFAULT_DIR/myplug.so
+ subdir/myplug.so     DEFAULT_DIR/subdir/myplug.so
+ ./subdir/myplug.so   CWD/subdir/myplug.so
+ /usr/lib/my/plug.so  /usr/lib/my/plug.so
+</PRE>
+
+<P>
+DEFAULT_DIR is replaced by the default plug-in directory,
+which is configured at the build time of OpenVPN.  CWD is the
+current directory where OpenVPN was started or the directory
+OpenVPN have swithed into via the
+
+option before the
+
+option.
+<P>
 For more information and examples on how to build OpenVPN
 plug-in modules, see the README file in the
@@ -4839 +4866 @@
 description of the OpenVPN challenge/response protocol.
 
-<DT><B>--server-poll-timeout n</B>
-
-<DD>
-<B>--connect-timeout n</B>
-
-when connecting to a remote server do not wait for more than
+<DT><B>--server-poll-timeout n</B>, <B>--connect-timeout n</B><DD>
+When connecting to a remote server do not wait for more than
 <B>n</B>
 
@@ -6473 +6496 @@
 options can be defined to track multiple attributes.
 
-<DT><B>--ns-cert-type client|server</B>
-
-<DD>
+<DT><B>--ns-cert-type client|server (DEPRECATED)</B>
+
+<DD>
+This option is deprecated.  Use the more modern equivalent
+<B>--remote-cert-tls</B>
+
+instead.  This option will be removed in OpenVPN 2.5.
+<P>
 Require that peer certificate was signed with an explicit
 <B>nsCertType</B>
@@ -6506 +6534 @@
 
 
-<DT><B>--remote-cert-ku v...</B>
+<DT><B>--remote-cert-ku [v...]</B>
 
 <DD>
@@ -6513 +6541 @@
 
 <P>
+If present in the certificate, the keyUsage value is validated by the TLS
+library during the TLS handshake.  Specifying this option without arguments
+requires this extension to be present (so the TLS library will verify it).
+<P>
+If the list
+<B>v...</B>
+
+is also supplied, the keyUsage field must have
+<B>at least</B>
+
+the same bits set as the bits in
+<B>one of</B>
+
+the values supplied in the list
+<B>v...</B>
+
+<P>
+The key usage values in the list must be encoded in hex, e.g.
+&quot;--remote-cert-ku a0&quot;
+
+<DT><B>--remote-cert-eku oid</B>
+
+<DD>
+Require that peer certificate was signed with an explicit
+<B>extended key usage.</B>
+
+<P>
 This is a useful security option for clients, to ensure that
 the host they connect to is a designated server.
 <P>
-The key usage should be encoded in hex, more than one key
-usage can be specified.
-
-<DT><B>--remote-cert-eku oid</B>
-
-<DD>
-Require that peer certificate was signed with an explicit
-<B>extended key usage.</B>
-
-<P>
-This is a useful security option for clients, to ensure that
-the host they connect to is a designated server.
-<P>
 The extended key usage should be encoded in oid notation, or
 OpenSSL symbolic representation.
@@ -6543 +6585 @@
 based on RFC3280 TLS rules.
 <P>
-This is a useful security option for clients, to ensure that
-the host they connect to is a designated server.
+This is a useful security option for clients, to ensure that the host they
+connect to is a designated server.  Or the other way around; for a server to
+verify that only hosts with a client certificate can connect.
 <P>
 The
@@ -6550 +6593 @@
 
 option is equivalent to
-<B>--remote-cert-ku 80 08 88 --remote-cert-eku &quot;TLS Web Client Authentication&quot;</B>
-
-<P>
-The key usage is digitalSignature and/or keyAgreement.
+<B>--remote-cert-ku --remote-cert-eku &quot;TLS Web Client Authentication&quot;</B>
+
 <P>
 The
@@ -6559 +6600 @@
 
 option is equivalent to
-<B>--remote-cert-ku a0 88 --remote-cert-eku &quot;TLS Web Server Authentication&quot;</B>
-
-<P>
-The key usage is digitalSignature and ( keyEncipherment or keyAgreement ).
+<B>--remote-cert-ku --remote-cert-eku &quot;TLS Web Server Authentication&quot;</B>
+
 <P>
 This is an important security precaution to protect against
@@ -7104 +7143 @@
 <DD>
 Ask Windows to release the TAP adapter lease on shutdown.
-This option has the same caveats as
-<B>--dhcp-renew</B>
-
-above.
+This option has no effect now, as it is enabled by default starting with version 2.4.1.
 
 <DT><B>--register-dns</B>
@@ -8970 +9006 @@
 <A HREF="/cgi-bin/man/man2html">man2html</A>,
 using the manual pages.<BR>
-Time: 12:41:06 GMT, December 27, 2016
+Time: 14:20:48 GMT, March 22, 2017
 }}}