Multiple CAs: stacking, using --capath

The goal of this recipe is to create an OpenVPN setup where the client certificates are signed by a "client-only" CA and the server certificate is signed by a different "server-only" CA. This provides an extra level of operational security, where one person is allowed to create only client certificates whereas another is allowed to generate only a server certificate. This ensures that the client and server certificates can never be mixed for a Man-in-the-Middle attack.

Getting ready

Set up the server certificate using the first recipe from Chapter 2. Use the client certificate and the intermediary CA certificate from the previous recipe. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Fedora 12 Linux and OpenVPN 2.1.1.

How to do it...

1. Create the server configuration file:

   tls-server
   proto udp
   port 1194
   dev tun
   
   server 192.168.200.0 255.255.255.0
   
   ca       /etc/openvpn/cookbook/ca+subca.pem
   cert  ...