Re: Two questions about key generation for clients

>On Wednesday, January 17th, 2024 at 11:23 AM, Gert Doering <[email protected]> wrote:


> Hi,
> 
> On Wed, Jan 17, 2024 at 07:45:21AM +0000, Peter Davis wrote:
> 
> > I use the OpenVPN Connect app on Android and PC. When I connect to the server with the same key on two devices, the OpenVPN Connect app on the previous client does not disconnect. Why?
> 
> 
> Read the server logs.
> 
> gert
> --
> "If was one thing all people took for granted, was conviction that if you
> feed honest figures into a computer, honest figures come out. Never doubted
> it myself till I met a computer with a sense of humor."
> Robert A. Heinlein, The Moon is a Harsh Mistress
> 
> Gert Doering - Munich, Germany [email protected]


Hi,
Thanks again.
The server logs are:

First Client

2024-01-17 13:17:11 172.20.1.254:57441 VERIFY OK: depth=1, CN=Coders_Server
2024-01-17 13:17:11 172.20.1.254:57441 VERIFY OK: depth=0, CN=Coders_Client
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_VER=2.6.5
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_PLAT=win
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_TCPNL=1
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_MTU=1600
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_CIPHERS=AES-256-GCM
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_PROTO=990
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_LZO_STUB=1
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_COMP_STUB=1
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_COMP_STUBv2=1
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_GUI_VER=OpenVPN_GUI_11
2024-01-17 13:17:11 172.20.1.254:57441 peer info: IV_SSO=openurl,webauth,crtext
2024-01-17 13:17:11 172.20.1.254:57441 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2024-01-17 13:17:11 172.20.1.254:57441 TLS: tls_multi_process: initial untrusted session promoted to trusted
2024-01-17 13:17:11 172.20.1.254:57441 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2024-01-17 13:17:11 172.20.1.254:57441 [Coders_Client] Peer Connection Initiated with [AF_INET]172.20.1.254:57441
2024-01-17 13:17:11 Coders_Client/172.20.1.254:57441 MULTI_sva: pool returned IPv4=20.20.0.2, IPv6=(Not enabled)
2024-01-17 13:17:11 Coders_Client/172.20.1.254:57441 MULTI: Learn: 20.20.0.2 -> Coders_Client/172.20.1.254:57441
2024-01-17 13:17:11 Coders_Client/172.20.1.254:57441 MULTI: primary virtual IP for Coders_Client/172.20.1.254:57441: 20.20.0.2
2024-01-17 13:17:11 Coders_Client/172.20.1.254:57441 SENT CONTROL [Coders_Client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 1.1.1.1,dhcp-option DNS 9.9.9.9,route-gateway 20.20.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 20.20.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500' (status=1)
2024-01-17 13:17:12 Coders_Client/172.20.1.254:57441 Data Channel: cipher 'AES-256-GCM', peer-id: 0
2024-01-17 13:17:12 Coders_Client/172.20.1.254:57441 Timers: ping 10, ping-restart 240
2024-01-17 13:17:12 Coders_Client/172.20.1.254:57441 Protocol options: explicit-exit-notify 1, protocol-flags cc-exit tls-ekm dyn-tls-crypt


Second Client

2024-01-17 13:17:56 172.20.1.254:39800 VERIFY OK: depth=1, CN=Coders_Server
2024-01-17 13:17:56 172.20.1.254:39800 VERIFY OK: depth=0, CN=Coders_Client
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_VER=3.git::081bfebe:RelWithDebInfo
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_PLAT=android
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_NCP=2
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_TCPNL=1
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_PROTO=30
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_AUTO_SESS=1
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_GUI_VER=net.openvpn.connect.android_3.3.4-9290
2024-01-17 13:17:56 172.20.1.254:39800 peer info: IV_SSO=webauth,openurl,crtext
2024-01-17 13:17:56 172.20.1.254:39800 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2024-01-17 13:17:56 172.20.1.254:39800 TLS: tls_multi_process: initial untrusted session promoted to trusted
2024-01-17 13:17:56 172.20.1.254:39800 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2024-01-17 13:17:56 172.20.1.254:39800 [Coders_Client] Peer Connection Initiated with [AF_INET]172.20.1.254:39800
2024-01-17 13:17:56 MULTI: new connection by client 'Coders_Client' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
2024-01-17 13:17:56 MULTI_sva: pool returned IPv4=20.20.0.2, IPv6=(Not enabled)
2024-01-17 13:17:56 MULTI: Learn: 20.20.0.2 -> Coders_Client/172.20.1.254:39800
2024-01-17 13:17:56 MULTI: primary virtual IP for Coders_Client/172.20.1.254:39800: 20.20.0.2
2024-01-17 13:17:56 SENT CONTROL [Coders_Client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 1.1.1.1,dhcp-option DNS 9.9.9.9,route-gateway 20.20.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 20.20.0.2 255.255.255.0,peer-id 1,cipher AES-256-GCM,key-derivation tls-ekm' (status=1)
2024-01-17 13:17:56 Coders_Client/172.20.1.254:39800 PUSH: Received control message: 'PUSH_REQUEST'
2024-01-17 13:17:57 Coders_Client/172.20.1.254:39800 Data Channel: cipher 'AES-256-GCM', peer-id: 0
2024-01-17 13:17:57 Coders_Client/172.20.1.254:39800 Timers: ping 10, ping-restart 240
2024-01-17 13:17:57 Coders_Client/172.20.1.254:39800 Protocol options: explicit-exit-notify 1, protocol-flags tls-ekm


As you can see, both clients are connected to the server with the same key. When the second client connects, OpenVPN Connect on the first client is still connected but not working.