tls-remote workaround for openvpn on Ubuntu 17.10

Question

I try to work around that the option

--tls-remote

was removed in openvpn 2.4 so my openvpn config file does not work any more.

I tried to downgrade openvpn from 2.4 in Ubuntu 17.10 down to 2.3.4:

apt remove openvpn
wget http://ftp.us.debian.org/debian/pool/main/o/openvpn/openvpn_2.3.4-5+deb8u2_amd64.deb
dpkg -i openvpn_2.3.4-5+deb8u2_amd64.deb

But it seems like 2.3 is not compatible with Ubuntu 17.10: it sais, missing package initscripts which is not installable on 17.10.

What can I do to get my old config running? Or can I change the config, so it works with 2.4? This is the offending line:

tls-remote "/C=de/L=SomeTown/O=Something/CN=asg.myserver.de/[email protected]"

Answer 1

The new configuration option to use is verify-x509-name it appears to expect a comma and space separated list for your Distinguished Name (DN):

verify-x509-name 'C=de, L=SomeTown, O=Something, CN=asg.myserver.de, [email protected]'

This information is from the OpenVPN man page for 2.4, in the TLS Mode Options section. The example there only uses the C, ST, L and CN parts to make up the DN, but it looks like it should work with other DN components

Answer 2

You have to replace the --tls-remote name with the new --verify-x509-name name type directive:

https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--tls-remote

So instead of the tls-remote command use this:

verify-x509-name 'C=de, L=SomeTown, O=Something, CN=asg.myserver.de, [email protected]'

strangely , this didnt work on my system, I got an error:

VERIFY X509NAME ERROR: C=de, L=SomeTown, O=Something, CN=asg.myserver.de, [email protected], must be C=de, L=SomeTown, O=Something, CN=asg.myserver.de, [email protected]

Which seems a really strange message, so I tried around some more options and found out, it works with the type name instead of the (default) type subject:

verify-x509-name asg.myserver.de name