Re: Is Client connections via ca.crt only possible?

On 2022-08-03 21:37, Rejo Oommen wrote:
> Thank you for the reply Thomas. I agree with you on the mutual TLS 
> that you mentioned.
>
> Here is what I was looking at.
>
> The configurations at the server end will be with auth-method as md5 
> and auth-option as clientcert=verify-ca.
>

There's your issue. If you tell the server to validate the client cert, 
then it will require the client to provide a valid cert to identify itself.

> In this way, the user's password along with the valid ca should allow 
> connections to pass.
>

The ca on your setup is only useful for the client to ensure the server 
is the correct one and prevent MITM attacks. This is a client-side 
check, not server-side.

The only authentication security here is the password/md5, but protected 
from eavesdropping (passive and MITM) and connection hijacking by 
encryption, with some of these protections only effective when the 
client use the verify-ca option. The server cannot ensure the client is 
actually validating the ca, not even that it's taking to the actual 
client and not a MITM, simply because the client itself is not 
authenticated by mutual TLS.

Regards

--
Thomas