4

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux machines may need to access cloud infrastructure when not VPN'ed into the gateway.

During the setup of OpenVPN gateway, I've created a local certificate authority (via easy-rsa) to issue client certificates for OpenVPN to encrypt traffic with and authenticate.

Now I need to generally identify a client machine connecting to my Node.js (or any, for that matter) backend. I wonder if I could use the OVPN issued certificates for this. If the client connecting to a backend can present a certificate, then I know who they are and will serve the required resources.

Is this a good practice to do so? The other way around would be to leave OpenVPN certificates be and just have some other layer of authorization for client machines, but that seems to be a bit of a duplication given I already have a CA and certs on the client side.

1

Not a full answer, but another thing to think about: with a system like that the easiest way for an attacker to gain access (ie the weakest link) is to steal the private keys to one of those client certs. Things to think about:

  • Are the linux machines physically secure, or do they leave the building (ie laptops)?
  • Do you have good policies for certificate revocation - both the software and human sides? For example, if a certificate was compromised as above, how many hours on average until it would be noticed and revoked?

I suppose these concerns aren't unique to certificate-based auth though, anything where auth keys are stored client-side will have the same concerns.

| improve this answer | |
  • Thanks for this concern. I am not sure if I am distributing a private or public keys along with the certificates on the Linux machines for VPN access. How can I tell? If I indeed do private keys, then this deprecates the security as I should consider the Linux machine to be the most possible target of an attack, since potential attackers may have access to the machine's disk. – Maxim V. Pavlov Aug 24 '15 at 14:30
  • 2
    Certificates do not provide authentication unless the client has both the certificate and the private key. In a nutshell, a client will present a cert, then the server will ask "are you the owner of this cert? If so prove it by singing something with the matching private key". You should probably read up on this before deciding to use a tech that you don't fully understand. Some key-words for you: public key infrastructure, certificate based authentication, challenge-response authentication. – Mike Ounsworth Aug 24 '15 at 14:38
  • Thanks. I read up some info but wasn't clearly sure about that point. Will do more. – Maxim V. Pavlov Aug 24 '15 at 15:06
  • Mike, does the public key for an issued pk+cer pair stays with the CA in case of OpenVPN? I know this is kind of an offtopic in this case, but if it's an easy one for you, I'd appreciate a clarification on this as well. – Maxim V. Pavlov Aug 24 '15 at 15:13
  • 1
    I've never used OpenVPN, but generally the client generates a private key and never shares it with anybody. The public key gets made into a cert (public key == cert) and since it's public, every body in the world gets a copy of it. – Mike Ounsworth Aug 24 '15 at 15:24
1

It may not be best practice because you're using a specific-purpose CA (in which case, authenticating your OpenVPN clients) for something else, but security-wise, as long as that CA is secure, your solution is fine.

I would recommend however putting the private key of that CA certificate somewhere safe, like a smartcard, a completely offline computer or an HSM.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.