From: Frank Lichtenheld Date: Wed, 19 Nov 2025 13:52:38 +0000 (+0100) Subject: doc: Document potential filesystem pitfalls of client-config-dir X-Git-Tag: v2.7_rc3~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8d278223df96e74e9b7ad8ae962ac28761a6fb19;p=thirdparty%2Fopenvpn.git doc: Document potential filesystem pitfalls of client-config-dir Reported-By: stefan@srlabs.de Change-Id: I23ea00dbd62271838aa72e913b743cc679ff2386 Signed-off-by: Frank Lichtenheld Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1380 Message-Id: <20251119135243.30967-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34541.html Signed-off-by: Gert Doering --- diff --git a/doc/man-sections/server-options.rst b/doc/man-sections/server-options.rst index 5243a060b..739be220c 100644 --- a/doc/man-sections/server-options.rst +++ b/doc/man-sections/server-options.rst @@ -144,6 +144,16 @@ fast hardware. SSL/TLS authentication must be used in this mode. ``--push-reset``, ``--push-remove``, ``--iroute``, ``--ifconfig-push``, ``--vlan-pvid`` and ``--config``. + **Note:** OpenVPN uses the CN exactly as written in the certificate. + But since this is a file access the filesystem might interfere. + Importantly OpenVPN will consider two CNs that only differ in case as + different names but a case-insensitive filesystem (like you might + encounter on Windows or macOS) will treat them as the same. When you + generate your certificates make sure that the CNs are sufficiently + different to not cause issues. When trusting an external CA note that + this is a potential attack vector via maliciously generated + certificates that exploit this issue. + --client-to-client Because the OpenVPN server mode handles multiple clients through a single tun or tap interface, it is effectively a router. The