OpenVPN / OpenVPN/openvpn

verify-x509-name inside <connection> block prevents multi-server configuration in OpenVPN

Open
#744 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Hello OpenVPN team,
I'm encountering an issue when configuring multiple servers in an .ovpn configuration file.
Normally, when using a single server, the configuration includes:

remote 37.19.212.217 443 tcp
verify-x509-name CN=ca1531.nordvpn.com

However, when I attempt to add multiple servers using the block as follows:
<connection>
remote 37.19.212.212 443 tcp
verify-x509-name CN=ca1530.nordvpn.com
</connection>

<connection>
remote 37.19.212.217 443 tcp
verify-x509-name CN=ca1531.nordvpn.com
</connection>

OpenVPN throws an error and requires verify-x509-name to be placed outside the block.
This restriction means I am unable to include multiple servers in the same .ovpn configuration file while preserving unique certificate verification settings for each one.

Expected Behavior:
It should be possible to define multiple connections with individual verify-x509-name values within the <connection> block.

Observed Behavior:
When verify-x509-name is included inside a block, OpenVPN fails to parse the configuration correctly, requiring the directive to be placed globally instead of per connection.

Possible Solutions:

  • Allow verify-x509-name within each <connection> block so that different servers can be defined with their respective certificates.
  • Provide an alternative way to specify verify-x509-name per server in a multi-server setup.
    Would you be able to clarify whether this is an intentional restriction or if it's something that can be addressed in a future update?

Thank you for your support!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the parsing failure with the two examples in the issue, then trace the configuration handling for verify-x509-name and connection blocks. Confirm whether per-connection certificate names are supported or intentionally rejected. Done means multiple connections parse successfully with distinct verify-x509-name values, or the restriction is documented with an alternative configuration approach.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.