feat: use remote-cert-tls server openvpn client config

bindata/bindata.go

@@ -92,7 +92,7 @@ func templateCcdFileTmpl() (*asset, error) {
 	return a, nil
 }
 
-var _templateClientOvpnTmpl = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x3c\xcd\x31\x4b\x3c\x31\x10\x05\xf0\x7e\x3e\xc5\xc0\xbf\xf9\x5b\xec\xa5\xb0\x93\x45\x10\x1b\x41\xc4\xab\x6c\xc4\x22\x9b\x9d\xbb\x1d\x2e\xc9\x84\x64\x36\x10\x8f\x7c\x77\xd9\x3d\xb1\x9b\xf7\x1b\x78\xef\x1f\xea\xc2\x05\xa5\xa6\x88\x27\xf6\x84\x5c\xd0\xae\x2a\xc1\x2a\x3b\xeb\x7d\xc3\x33\x45\xca\x56\x69\xc6\xa9\xe1\xe7\xfb\xc7\xf1\xed\xeb\xff\xa2\x9a\xca\x83\x31\x67\xd6\x65\x9d\x0e\x4e\x82\x71\x76\x36\x52\x53\xb8\x03\x70\x9e\x29\x2a\xcc\x54\x51\xd7\x08\x29\x8b\x0a\xae\x73\x82\x4c\x41\x94\xf0\x7a\xc5\xc3\x8b\x14\x8d\x36\x10\xf6\xbe\xe7\xa3\x64\xc5\xde\x21\x53\x11\x5f\x87\x4c\x9a\x1b\x72\x3c\x71\x64\x25\x88\x32\x71\x9c\x21\x51\x2e\x5c\x74\xb8\x50\xfb\xbb\xb7\x05\x27\x21\x0d\xfe\x5b\xa0\x52\x9e\xf0\x1e\x60\x74\xf6\x11\xb6\xda\xe7\x27\xec\x7d\x34\x5b\x1c\x1d\x65\xfd\x55\xda\xc7\x46\x73\xa3\xf1\x42\xed\xf6\x78\xa5\xb6\xfb\x0e\x3f\x01\x00\x00\xff\xff\xad\xef\x2e\x30\x1b\x01\x00\x00")
+var _templateClientOvpnTmpl = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x3c\x8e\xb1\x6a\x03\x31\x0c\x86\x77\x3d\x85\xa0\x4b\x3b\x5c\x3c\x74\x2b\x47\xa1\x74\x29\x94\xd2\x4c\x5d\x4a\x07\x9f\x4f\x49\x4c\x6c\xcb\xc8\x3a\x83\x1b\xfc\xee\xe5\x2e\xa1\x9b\xfe\x4f\x48\xdf\x7f\x87\x7a\xf2\x05\xb9\xe6\x84\x07\x1f\x08\x7d\x41\xbb\x28\x47\xab\xde\xd9\x10\x1a\x1e\x29\x91\x58\xa5\x19\xa7\x86\xdf\x9f\x5f\xfb\x8f\x9f\xfb\x93\x6a\x2e\x4f\xc6\x1c\xbd\x9e\x96\x69\xe7\x38\x1a\x67\x67\xc3\x35\xc7\x07\x00\x17\x3c\x25\x85\x99\x2a\xea\x92\x20\x0b\x2b\xe3\x32\x67\x10\x8a\xac\x84\x97\x0b\xee\xde\xb8\x68\xb2\x91\xb0\xf7\x2d\xef\x59\x14\x7b\x07\xa1\xc2\xa1\x0e\x42\x2a\x0d\x7d\x3a\xf8\xe4\x95\x6e\x87\x83\x23\xd1\x41\x43\xc1\x42\x52\x49\x20\xf1\xe4\xd3\x0c\x99\xa4\xf8\xa2\xc3\x99\xda\xff\xbc\x8a\x1d\xc7\x3c\x84\x5f\x86\x4a\x32\xe1\x23\xc0\xe8\xec\x33\xac\xb6\xd7\x17\xec\x7d\x34\x6b\x1c\xd7\xa7\x37\x4a\x5b\x87\xd1\x5c\xd1\x78\xa6\x76\x5d\xbc\x53\xdb\xf8\x06\xfe\x02\x00\x00\xff\xff\x96\xf9\x3e\xe7\x32\x01\x00\x00")
 
 func templateClientOvpnTmplBytes() ([]byte, error) {
 	return bindataRead(
@@ -107,7 +107,7 @@ func templateClientOvpnTmpl() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "template/client.ovpn.tmpl", size: 283, mode: os.FileMode(420), modTime: time.Unix(1502173553, 0)}
+	info := bindataFileInfo{name: "template/client.ovpn.tmpl", size: 306, mode: os.FileMode(420), modTime: time.Unix(1502656204, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }

pki/pki.go

@@ -164,11 +164,13 @@ func newCert(ca *CA, server bool, cn string) (*CertHolder, error) {
 			CommonName:   cn,
 			Organization: []string{"OVPM"},
 		},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 		BasicConstraintsValid: true,
 	}
 
 	if server {
+		tml.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement | x509.KeyUsageKeyEncipherment
 		tml.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
 	}
 

template/client.ovpn.tmpl

@@ -5,6 +5,7 @@ dev tun
 proto udp
 remote {{ .Hostname }} {{ .Port }}
 resolv-retry infinite
+remote-cert-tls server
 nobind
 persist-key
 persist-tun