1

This question already has an answer here:

Currently installing the OpenVPN service on my Linux box and stumbled across this in a guide:

All of our clients will also need certificates to be able to authenticate. These keys and certificates will be shared with your clients, and it's best to generate separate keys and certificates for each client you intend on connecting.

https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-7

May somebody please explain why it's important to generate a pair for each client? Are there security risks if, for example, 2 clients use the same pair? As far as I can remember, my school and workplace does offer one pair for all users if they want to use the VPN service.

marked as duplicate by RoraΖ, Jens Erat, Xander, Rory Alsop Jan 14 '15 at 18:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    It's just in case someone leaves the organisation. You can revoke their certificate, rather than have to reissue everyone else a new cert. – paj28 Jan 14 '15 at 14:20
2

You can authenticate based on certificate, username/password or by using a combination.

The reason why you do not want to use just a single certificate, without username or password, is that it will reduce your accountability as you can't pinpoint a single connection to a single person with certainty. You can use username and password as a measure to resolve this issue.

It's better to implement a certificate per client as well as username/password. It will give you a form of 2 factor authentication setup (its effectiveness is debatable if stored on the same computer).

  • Something the client has: his certificate

  • Something the client knows: username and password

Not the answer you're looking for? Browse other questions tagged or ask your own question.