Is OpenVPN With No Client Certificates Encrypted?

Question

We recently installed a pfSense based firewall which with little fuss generated an OpenVPN installer that contains no client side certificates. Most members of our team have used OpenVPN in some capacity or another over the last 10 years and have always had client side certificates as part of the installation. As a result a debate has ensued questioning if the tunnel is encrypted if there is no client side certificates. After quite a lot of searching we cannot come to a definitive conclusion.

We recognize the value of client side certificates, but for just for purposes of knowledge with account and password based authentication and no client certificates is OpenVPN an unencrypted tunnel?

We did use Wireshark and generate some simple UDP traffic with netcat and it appeared encrypted, but for the nay-sayers this was not enough evidence. The docs do not clearly state that the tunnel is always encrypted although they do discuss not using client side certificates and even mention that since 2.0 secure exchange of account and password data is available without client side certificates.

Is there citable documentation that supports a conclusion?

Answer 1

There is a x509 extension called Key usage extension , which is marked as a critical extension. These extensions specify the scope of usage of the key associated with the certificate .

Few common one are :

Digital signature
Key encipherment

No extension specifies that this particular certificate is for encryption , so you can conclude from here only, providing client with extra certificate will only provide a kind of entity authentication ( the device on which client certificate is installed is valid to proceed to application level authentication )

After this ssl authentication there is no difference between your current setup and the setup with client certificates , Communication will be equally strong in both as key with same strength will be derived after ssl handshake is done in both cases

Answer 2

Client certificates are not used for encryption in OpenVPN. These are "only" used for authentication of the client, i.e. that only clients which provide a trusted certificate can use the VPN.