verify-x509-name inside <connection> block prevents multi-server configuration in OpenVPN
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Hello OpenVPN team,
I'm encountering an issue when configuring multiple servers in an .ovpn configuration file.
Normally, when using a single server, the configuration includes:
remote 37.19.212.217 443 tcp
verify-x509-name CN=ca1531.nordvpn.com
However, when I attempt to add multiple servers using the block as follows:
<connection>
remote 37.19.212.212 443 tcp
verify-x509-name CN=ca1530.nordvpn.com
</connection>
<connection>
remote 37.19.212.217 443 tcp
verify-x509-name CN=ca1531.nordvpn.com
</connection>
OpenVPN throws an error and requires verify-x509-name to be placed outside the block.
This restriction means I am unable to include multiple servers in the same .ovpn configuration file while preserving unique certificate verification settings for each one.
Expected Behavior:
It should be possible to define multiple connections with individual verify-x509-name values within the <connection> block.
Observed Behavior:
When verify-x509-name is included inside a block, OpenVPN fails to parse the configuration correctly, requiring the directive to be placed globally instead of per connection.
Possible Solutions:
- Allow verify-x509-name within each <connection> block so that different servers can be defined with their respective certificates.
- Provide an alternative way to specify verify-x509-name per server in a multi-server setup.
Would you be able to clarify whether this is an intentional restriction or if it's something that can be addressed in a future update?
Thank you for your support!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the parsing failure with the two examples in the issue, then trace the configuration handling for verify-x509-name and connection blocks. Confirm whether per-connection certificate names are supported or intentionally rejected. Done means multiple connections parse successfully with distinct verify-x509-name values, or the restriction is documented with an alternative configuration approach.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100