Re: Openvpn unmatched entries

Geert Janssens wrote:
> Hi,
> 
> I have attached a small patch to the openvpn script that fixes two issues:
> 
> 1. The DN's displayed in the Verify section are incomplete: the last part of 
> the DN is cut of each time.
> For example:
> DN /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net/[email protected]
> is reported as 
> DN /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net
> or
> DN /C=be/O=AbitMORE bvba/CN=intranet.abitmore.be
> is reported as
> DN /C=be/O=AbitMORE bvba
> 
> 2. Using the client config option tls-remote to explicitly require one 
> specific server certificate results in an unmatched entry:
> VERIFY X509NAME OK: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 24 Time(s)
> 
> I have chosen to add an additional line in the Verify section of the report 
> that reports the tls-remote verification results. To keep the report aligned, 
> I have also added "Depth: x" to the lines that were already there. I am not 
> really sure about this Depth addition though. Maybe another word would be 
> more appropriate to indicate the difference between tls-remote verification 
> (X509Name) and default tls handshake certificate verification.
> 
> The verify section in my report now looks like this :
>  Verify
>     status: OK X509Name DN: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 721 
> Time(s)
>     status: OK depth: 0 DN: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 721 
> Time(s)
>     status: OK depth: 1 
> DN: /C=BE/O=PHVriens_bvba/CN=PHVriens_Certificate_Authority/[email protected]: 
> 721 Time(s)
> (sorry for the line wraps)
>


Committed to CVS.

-Mike