We recently installed a pfSense based firewall which with little fuss generated an OpenVPN installer that contains no client side certificates. Most members of our team have used OpenVPN in some capacity or another over the last 10 years and have always had client side certificates as part of the installation. As a result a debate has ensued questioning if the tunnel is encrypted if there is no client side certificates. After quite a lot of searching we cannot come to a definitive conclusion.

We recognize the value of client side certificates, but for just for purposes of knowledge with account and password based authentication and no client certificates is OpenVPN an unencrypted tunnel?

We did use Wireshark and generate some simple UDP traffic with netcat and it appeared encrypted, but for the nay-sayers this was not enough evidence. The docs do not clearly state that the tunnel is always encrypted although they do discuss not using client side certificates and even mention that since 2.0 secure exchange of account and password data is available without client side certificates.

Is there citable documentation that supports a conclusion?


There is a x509 extension called Key usage extension , which is marked as a critical extension. These extensions specify the scope of usage of the key associated with the certificate .

Few common one are :

Digital signature
Key encipherment

No extension specifies that this particular certificate is for encryption , so you can conclude from here only, providing client with extra certificate will only provide a kind of entity authentication ( the device on which client certificate is installed is valid to proceed to application level authentication )

After this ssl authentication there is no difference between your current setup and the setup with client certificates , Communication will be equally strong in both as key with same strength will be derived after ssl handshake is done in both cases

  • 8zero2.ops Will always be happy to help you. .. – Arjun sharma Oct 27 '16 at 2:22

Client certificates are not used for encryption in OpenVPN. These are "only" used for authentication of the client, i.e. that only clients which provide a trusted certificate can use the VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.