sigh

openvpn/server.conf

@@ -1,6 +1,8 @@
 # OpenVPN road-warrior endpoint — RackNerd hub
-# Auth chain: client cert (offline CA) + user/pass -> PAM -> RADIUS
+# Auth chain: AD user/pass -> PAM -> RADIUS
 #             -> Duo Auth Proxy (127.0.0.1:1812) -> LDAPS to the DCs.
+# No individual client certs: identity is LDAP + Duo only. tls-crypt
+# (shared key in the profile) still gates who can attempt a handshake.
 
 port 1194
 proto udp4
@@ -25,23 +27,21 @@ push "dhcp-option DOMAIN-SEARCH ad.oswaldtheotter.net"
 push "dhcp-option DOMAIN-SEARCH ad.trochalakis.net"
 push "block-outside-dns"
 
-# PKI — issued from the offline CA, see pki/README.md
+# PKI — server certificate only (offline CA, see pki/README.md);
+# clients present no certificate.
 ca   /etc/openvpn/pki/ca.crt
 cert /etc/openvpn/pki/server.crt
 key  /etc/openvpn/pki/server.key
 dh none
 tls-crypt /etc/openvpn/pki/ta.key
-# Enable once you publish a CRL from the offline CA (revoked laptops etc.):
-;crl-verify /etc/openvpn/pki/crl.pem
 
-remote-cert-tls client
 tls-version-min 1.2
 data-ciphers AES-256-GCM:CHACHA20-POLY1305
 auth SHA256
 
 # User auth via Duo (password only = push; "password,123456" = passcode)
 plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
-verify-client-cert require
+verify-client-cert none
 username-as-common-name
 hand-window 120        # allow time for the Duo push round-trip
 reneg-sec 0            # no mid-session TLS renegotiation (would re-prompt Duo)