[PR #1437] [MERGED] feat: add peer-fingerprint authentication mode (OpenVPN 2.6+) #421

New Issue

2026-11-11T16:41:47+01:00

Alvin-Zilverstand commented

2026-11-11 16:41:47 +01:00

📋 Pull Request Information

Original PR: https://github.com/angristan/openvpn-install/pull/1437
Author: @angristan
Created: 12/18/2025
Status: ✅ Merged
Merged: 12/18/2025
Merged by: @angristan

Base: master ← Head: feat/peer-fingerprint-auth

📝 Commits (10+)

7de1548 feat: add peer-fingerprint authentication mode (OpenVPN 2.6+)
7d3b42d style: fix shellcheck SC2129 warning in test script
56e7d15 fix: add error handling for fingerprint extraction
04dd2ee docs: fix misleading revocation claim in README
2fcc35c docs: remove redundant requirements section
5d813df docs: document fingerprint mode revocation tradeoff
76f656b docs: remove bold formatting
fa5cb5e fix: use comment line above fingerprint instead of inline
faf33a4 fix: delay service start in fingerprint mode until first client
e230f18 fix: move exit from newClient to callers

📊 Changes

4 files changed (+463 additions, -112 deletions)

View changed files

📝 .github/workflows/docker-test.yml (+10 -0)
📝 README.md (+41 -0)
📝 openvpn-install.sh (+286 -59)
📝 test/server-entrypoint.sh (+126 -53)

📄 Description

Summary

Implements support for OpenVPN's --peer-fingerprint option, enabling PKI-less authentication using SHA256 certificate fingerprints instead of a CA chain.

Closes #1361

Changes

Add --auth-mode option (pki or fingerprint) for install command
Use Easy-RSA's self-sign-server and self-sign-client commands for fingerprint mode
Server stores client fingerprints in <peer-fingerprint> block in server.conf
Clients verify server using peer-fingerprint directive instead of CA
Revocation removes fingerprint from config and reloads OpenVPN (instant effect)
Version check ensures OpenVPN 2.6+ when fingerprint mode is selected

Usage

# Interactive mode prompts for auth mode choice

# CLI mode
./openvpn-install.sh install --auth-mode fingerprint

Comparison

Aspect	PKI Mode	Fingerprint Mode
Server cert	CA-signed	Self-signed
Client cert	CA-signed	Self-signed
Revocation	CRL-based	Remove fingerprint
OpenVPN	Any version	2.6.0+ required
Best for	Large deployments	Small/home setups

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/angristan/openvpn-install/pull/1437 **Author:** [@angristan](https://github.com/angristan) **Created:** 12/18/2025 **Status:** ✅ Merged **Merged:** 12/18/2025 **Merged by:** [@angristan](https://github.com/angristan) **Base:** `master` ← **Head:** `feat/peer-fingerprint-auth` --- ### 📝 Commits (10+) - [`7de1548`](https://github.com/angristan/openvpn-install/commit/7de1548cf59038aed705c772a81272665cb6418c) feat: add peer-fingerprint authentication mode (OpenVPN 2.6+) - [`7d3b42d`](https://github.com/angristan/openvpn-install/commit/7d3b42d24950212abe9dac21276f8320ff8d99e7) style: fix shellcheck SC2129 warning in test script - [`56e7d15`](https://github.com/angristan/openvpn-install/commit/56e7d1515ca683cec8588b4815aea05af535e41b) fix: add error handling for fingerprint extraction - [`04dd2ee`](https://github.com/angristan/openvpn-install/commit/04dd2ee4ade472163ec7d2342dcce03357ad70dc) docs: fix misleading revocation claim in README - [`2fcc35c`](https://github.com/angristan/openvpn-install/commit/2fcc35c50ebc35b319f49a9021bc5b8907865b5b) docs: remove redundant requirements section - [`5d813df`](https://github.com/angristan/openvpn-install/commit/5d813df9b9afc091ea13f4da9f800ae1d2ebfade) docs: document fingerprint mode revocation tradeoff - [`76f656b`](https://github.com/angristan/openvpn-install/commit/76f656bd9fc17b8dbebc14e3212276d0a66693a3) docs: remove bold formatting - [`fa5cb5e`](https://github.com/angristan/openvpn-install/commit/fa5cb5e187a80c872167ee7308c58a23dc8f16c3) fix: use comment line above fingerprint instead of inline - [`faf33a4`](https://github.com/angristan/openvpn-install/commit/faf33a4c1166f2f111880335b95d9f43734e9387) fix: delay service start in fingerprint mode until first client - [`e230f18`](https://github.com/angristan/openvpn-install/commit/e230f18bb7a3652fbfdd912d425191823f2bb66f) fix: move exit from newClient to callers ### 📊 Changes **4 files changed** (+463 additions, -112 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/docker-test.yml` (+10 -0) 📝 `README.md` (+41 -0) 📝 `openvpn-install.sh` (+286 -59) 📝 `test/server-entrypoint.sh` (+126 -53) </details> ### 📄 Description ## Summary Implements support for OpenVPN's `--peer-fingerprint` option, enabling PKI-less authentication using SHA256 certificate fingerprints instead of a CA chain. Closes #1361 ## Changes - Add `--auth-mode` option (`pki` or `fingerprint`) for install command - Use Easy-RSA's `self-sign-server` and `self-sign-client` commands for fingerprint mode - Server stores client fingerprints in `<peer-fingerprint>` block in `server.conf` - Clients verify server using `peer-fingerprint` directive instead of CA - Revocation removes fingerprint from config and reloads OpenVPN (instant effect) - Version check ensures OpenVPN 2.6+ when fingerprint mode is selected ## Usage ```bash # Interactive mode prompts for auth mode choice # CLI mode ./openvpn-install.sh install --auth-mode fingerprint ``` ## Comparison | Aspect | PKI Mode | Fingerprint Mode | |--------|----------|------------------| | Server cert | CA-signed | Self-signed | | Client cert | CA-signed | Self-signed | | Revocation | CRL-based | Remove fingerprint | | OpenVPN | Any version | 2.6.0+ required | | Best for | Large deployments | Small/home setups | --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

Alvin-Zilverstand added the pull-request label 2026-11-11 16:41:47 +01:00

Alvin-Zilverstand closed this issue

2026-11-11 16:41:47 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/openvpn-install#421