5

Can I use the same paid SSL certificate for OpenVPN and Apache?

UPDATE: The purpose is to get a Estonian National ID card support to both. So that one, using this smart card, may authenticate himself with his personal PIN code for Apache for accessing restricted web pages and also authenticate himself to OpenVPN server using the same PIN. The issuer of the certificate is okay with this.

Henno
  • 1,056
  • 5
  • 19
  • 33

3 Answers3

4

Yes it should be technically possible. Remember, there's nothing magical about a SSL certificate. As far as Apache, OpenVPN or any other application is concerned your SSL certificate is just a bunch of pseudo-random bits.

Whether or not this is a good idea depends upon your goals. More details would be helpful.

It also occurs to me that this might violate the terms under which you purchased your signed SSL certificate from your 3rd party. Again, more details would be helpful.

  • 2
    Re "just a bunch of pseudo-random bits": The certificate *does* have to have the appropriate key usage (*serverAuth*; for OpenVPN *nsCertType=server* is needed too). – user1686 Mar 05 '11 at 19:38
  • @grawity. Ahh, right you are. –  Mar 05 '11 at 22:04
3

You may be better off using a local certificate authority for OpenVPN. This will give you better access control. You can limit access to clients signed by that authority.

It is unlikely you will be able to sign certificates for clients with your paid certificates. Signing certificates are usually significantly more expensive.

You can use your paid certificates for other servers such as LDAP, SMTP, IMAP, and POP as long as the domain matches the certificate. Like any other servers ensure you secure these services before enabling them over the network.

BillThor
  • 27,737
  • 3
  • 37
  • 69
1

I believe the only thing you'd have to worry about is making sure the key usage and extended key usage on your cert match any key usage restrictions you've configured for OpenVPN.

Cakemox
  • 25,209
  • 6
  • 44
  • 67
  • could you point to some documentation covering those areas? What should I tell to the issuer? – Henno Mar 29 '11 at 18:05
  • 1
    http://openvpn.net/index.php/open-source/documentation/howto.html#secnotes - that gives you some idea of how the key usages can be used with OpenVPN. You can ask your issuer which key usage attributes will be set on your certificate. – Cakemox Mar 29 '11 at 18:52