http://mikrotik.moscow Новое в теме Сделано. OpenVPN с require-client-certificate = yes форума RouterOS на сайте Mikrotik.moscow [mikrotik.moscow] ru http://backend.userland.com/rss2 Wed, 05 Aug 2026 05:23:19 -0400 Сделано. OpenVPN с require-client-certificate = yes RouterOS в форуме RouterOS.
Привет всем! Я следовал вики-инструкциям для VPN (используя easy-rsa) и столкнулся с той же проблемой… Есть какие-нибудь решения? Спасибо.
15.03.2020 19:41:00, el_berto.]]> http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236645 http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236645 Sun, 15 Mar 2020 19:41:00 -0400 RouterOS Сделано. OpenVPN с require-client-certificate = yes RouterOS в форуме RouterOS.
Вчера вечером все заработало, но я не в восторге от ovpn в MT. Там так много функций не поддерживаются и не задокументированы. Вот как я сгенерировал сертификаты:

```
ServerSide
root@voyage:~/ca# openssl req -new -x509 -newkey rsa:4096 -keyout CAkey.pem -out CA.crt -days 3650
Generating a 4096 bit RSA private key
.........................................................................................................................................................................................................++
.......................................++
writing new private key to 'CAkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:Test
Email Address []:test@test.de
root@voyage:~/ca#
```

```
root@voyage:~/ca# openssl genrsa -out serverkey.pem -aes128 4096 -days 3650
Generating RSA private key, 4096 bit long modulus
.......................................................++
.........................................................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for serverkey.pem:
Verifying - Enter pass phrase for serverkey.pem:
root@voyage:~/ca#
```

```
root@voyage:~/ca# openssl rsa -in serverkey.pem -out serverkeyohnepass.pem
Enter pass phrase for serverkey.pem:
writing RSA key
root@voyage:~/ca#
```

```
root@voyage:~/ca# openssl req -new -key serverkey.pem -out serverreq.pem -nodes
Enter pass phrase for serverkey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:Test
Email Address []:test@test.de

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:12345678
An optional company name []:test
root@voyage:~/ca#
```

```
root@voyage:~/ca# echo 01 > serial
root@voyage:~/ca# touch index.txt
root@voyage:~/ca# openssl ca -in serverreq.pem -notext -out servercert.crt
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./CAkey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
       Serial Number: 1 (0x1)
       Validity
           Not Before: Jan  4 19:14:43 2014 GMT
           Not After : Jan  2 19:14:43 2024 GMT
       Subject:
           countryName               = DE
           stateOrProvinceName       = Bayern
           organizationName          = test
           organizationalUnitName    = test
           commonName                = Test
           emailAddress              = test@test.de
       X509v3 extensions:
           X509v3 Basic Constraints:
               CA:FALSE
           Netscape Comment:
               OpenSSL Generated Certificate
           X509v3 Subject Key Identifier:
               60:3D:74:48:76:0E:72:0F:D9:DC:D7:F8:62:29:B0:18:AF:18:0B:F9
           X509v3 Authority Key Identifier:
               keyid:C4:04:D3:57:37:CD:E3:37:11:68:6B:CC:AC:46:27:72:60:BA:A6:EC

Certificate is to be certified until Jan  2 19:14:43 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
root@voyage:~/ca# Clientside
root@voyage:~/ca# openssl genrsa -out clientkey.pem 4096
Generating RSA private key, 4096 bit long modulus
.............++
............................................................................................++
e is 65537 (0x10001)
root@voyage:~/ca#
```

```
root@voyage:~/ca# openssl req -new -key clientkey.pem -out clientreq.pem -nodes
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:DE
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:TestClient
Email Address []:test@test.de

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:12345678
An optional company name []:test
root@voyage:~/ca#
```

```
root@voyage:~/ca# openssl ca -in clientreq.pem -notext -out clientcert.crt
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./CAkey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
       Serial Number: 4 (0x2)
       Validity
           Not Before: Jan  4 19:31:05 2014 GMT
           Not After : Jan  2 19:31:05 2024 GMT
       Subject:
           countryName               = DE
           stateOrProvinceName       = Bayern
           organizationName          = test
           organizationalUnitName    = test
           commonName                = TestClient
           emailAddress              = test@test.de
       X509v3 extensions:
           X509v3 Basic Constraints:
               CA:FALSE
           Netscape Comment:
               OpenSSL Generated Certificate
           X509v3 Subject Key Identifier:
               DC:D1:0C:1D:C1:EE:EE:B7:25:6A:FB:5A:09:A0:AD:0E:3F:E5:36:22
           X509v3 Authority Key Identifier:
               keyid:C4:04:D3:57:37:CD:E3:37:11:68:6B:CC:AC:46:27:72:60:BA:A6:EC

Certificate is to be certified until Jan  2 19:31:05 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
root@voyage:~/ca#
```

Я сгенерировал сертификаты, но не в восторге от ovpn в MT. Там так много функций не поддерживаются и не задокументированы.
05.01.2014 09:37:00, drdotti.]]> http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236644 http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236644 Sun, 05 Jan 2014 09:37:00 -0500 RouterOS Сделано. OpenVPN с require-client-certificate = yes RouterOS в форуме RouterOS.
Какая у тебя конфигурация? Ты выбрал правильный сертификат в своей openvpn-конфигурации? Какой алгоритм/размер ключа/хэш ты используешь для своих сертификатов?
05.01.2014 03:26:00, patrickmkt.]]> http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236643 http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236643 Sun, 05 Jan 2014 03:26:00 -0500 RouterOS Сделано. OpenVPN с require-client-certificate = yes RouterOS в форуме RouterOS.
Привет, работает ли OpenVPN с require-client-certificate=yes? OpenVPN с require-client-certificate=no у меня работает. Но с “yes” всегда получаю ошибку “TLS handshake failed”. Использую MT V6.7 на сервере и клиенте. Я импортировал ServerCert & ServerKey & CAcert на сервер MT (у меня флаг KT на сервере и T на CAcert). Также импортировал ClientCert & ClientKey на клиент MT (у меня флаг KT). Если я пытаюсь изменить имя сертификата, WinBox пишет “Certificat subject is read only”. Но после изменения поля E-Mail и применения я также могу изменить имя.

С уважением,
Клаус
04.01.2014 18:50:00, drdotti.]]> http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236642 http://mikrotik.moscow/forum/forum57/61797-sdelano.-openvpn-s-require_client_certificate-_-yes/message236642 Sat, 04 Jan 2014 18:50:00 -0500 RouterOS