[Openvpn-devel] --tls-verify runs twice for a single cert in Peer-fingerprint mode

Mon, 24 May 2021 07:09:00 -0700 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

Is this expected ?

Server log:

2021-05-24 14:58:03 us=534606 10.10.201.226:60276 TLS CRYPT V2 VERIFY SCRIPT OK
2021-05-24 14:58:03 us=558066 10.10.201.226:60276 VERIFY KU OK
2021-05-24 14:58:03 us=558105 10.10.201.226:60276 Validating certificate 
extended key usage
2021-05-24 14:58:03 us=558120 10.10.201.226:60276 ++ Certificate has EKU (str) 
TLS Web Client Authentication, expects TLS Web Client Authentication
2021-05-24 14:58:03 us=558130 10.10.201.226:60276 VERIFY EKU OK
<EXOK> * EasyTLS-verify => CN: cli-arch-v21x connection allowed
2021-05-24 14:58:03 us=573751 10.10.201.226:60276 VERIFY SCRIPT OK: depth=0, 
CN=cli-arch-v21x
2021-05-24 14:58:03 us=573782 10.10.201.226:60276 VERIFY OK: depth=0, 
CN=cli-arch-v21x
2021-05-24 14:58:03 us=573911 10.10.201.226:60276 VERIFY KU OK
2021-05-24 14:58:03 us=573928 10.10.201.226:60276 Validating certificate 
extended key usage
2021-05-24 14:58:03 us=573939 10.10.201.226:60276 ++ Certificate has EKU (str) 
TLS Web Client Authentication, expects TLS Web Client Authentication
2021-05-24 14:58:03 us=573948 10.10.201.226:60276 VERIFY EKU OK
<EXOK> * EasyTLS-verify => CN: cli-arch-v21x connection allowed
2021-05-24 14:58:03 us=588472 10.10.201.226:60276 VERIFY SCRIPT OK: depth=0, 
CN=cli-arch-v21x
2021-05-24 14:58:03 us=588508 10.10.201.226:60276 VERIFY OK: depth=0, 
CN=cli-arch-v21x
2021-05-24 14:58:03 us=590929 10.10.201.226:60276 peer info: IV_VER=2.6_git

Client log:

2021-05-24 15:06:44 us=111054 TLS: Initial packet from 
[AF_INET]10.10.101.101:17332, sid=ae12d90b 6b413bf6
2021-05-24 15:06:44 us=120475 VERIFY KU OK
2021-05-24 15:06:44 us=121197 Validating certificate extended key usage
2021-05-24 15:06:44 us=122354 ++ Certificate has EKU (str) TLS Web Server 
Authentication, expects TLS Web Server Authentication
2021-05-24 15:06:44 us=122737 VERIFY EKU OK
* TLS Verify Script OK
2021-05-24 15:06:44 us=130217 VERIFY SCRIPT OK: depth=0, CN=srv-wiscii-v21x
2021-05-24 15:06:44 us=130598 VERIFY OK: depth=0, CN=srv-wiscii-v21x
2021-05-24 15:06:44 us=131581 VERIFY KU OK
2021-05-24 15:06:44 us=132268 Validating certificate extended key usage
2021-05-24 15:06:44 us=132828 ++ Certificate has EKU (str) TLS Web Server 
Authentication, expects TLS Web Server Authentication
2021-05-24 15:06:44 us=133364 VERIFY EKU OK
* TLS Verify Script OK
2021-05-24 15:06:44 us=137990 VERIFY SCRIPT OK: depth=0, CN=srv-wiscii-v21x
2021-05-24 15:06:44 us=138614 VERIFY OK: depth=0, CN=srv-wiscii-v21x


Thanks
R
-----BEGIN PGP SIGNATURE-----
Version: ProtonMail

wsBzBAEBCAAGBQJgq7M5ACEJEE+XnPZrkLidFiEECbw9RGejjXJ5xVVVT5ec
9muQuJ1+vAgApEpHTOh5m9D706+WEOMvXq6PiKxfLnnjowOMLS1ut+ts0Kj6
8JHutbqJarT+0rhiezfDlKqqdXrDLaW/5bfF0M0f9J8+BgZNGIKXSM2Tp39f
lSqJIF0kMdD/RQKYxGu5TaO3eLaaWTBbEdkyAHa+t74E7fIiTtxEdvgqVkWm
423h3PSsdnHcOaCQkM7KOGilmpq+Wz/5KEtjVlzhKyfscqtw3RUvtFgKOXYj
p+axmfzY1aqkQNQTz98nC4w06Vao7XUSQtjWYfznVdDd8rP/hHmWDwLtYNyR
yQnN+iPHg5JsAdmrQ+6m99bX+C8btSHUPfN/0jAifkZjmEwP/I9ckA==
=cwb8
-----END PGP SIGNATURE-----

Attachment: publickey - tincantech@protonmail.com - 0x09BC3D44.asc
Description: application/pgp-keys

Attachment: publickey - tincantech@protonmail.com - 0x09BC3D44.asc.sig
Description: PGP signature

_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel






















					Reply via email to