Closed ihipop closed 5 months ago
I've tried to change the
EASYRSA_DN
to cn_only
then change the commonName_max
of cn_only
to 128 in openssl-easyrsa.cnf
still,the error exists:
Using SSL:
* openssl OpenSSL 3.2.1 30 Jan 2024 (Library: OpenSSL 3.2.1 30 Jan 2024)
-----
Error making certificate request
4077017C547F0000:error:06800097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:crypto/asn1/a_mbstr.c:106:maxsize=64
Also, try changing easyrsa:6242
:
commonName_max = 64
Also, try changing
easyrsa:6242
:commonName_max = 64
have you tried? I can't make it work
The max appears to be 64.
your CloudConnexa of OpenVPN allows a common name to longer than 64 bytes
The EasyRSA commonName
64 character limit is sufficient for sensible requirements.
Taking ASCII characters 0-9
and a-z
gives a naming pool of:
36^64 = 4×10⁹⁹
More than enough.
Taking ASCII characters
0-9
anda-z
gives a naming pool of:36^64 = 4×10⁹⁹
More than enough.
@TinCanTech
If you use OpenVPN web auth, you will find out that every device has a device ID in the form of UUID, which is 36 bytes long
to distinguish every device with different devices with different common name, usually an enterprise email address is prefixed as a part of a common name, Just like what CloudConnexa of OpenVPN does. for example
TinCanTech@mail.TinCanTech.com/2BB779C3-7765-46AA-9EB2-8E9BFC0500D8
tata, exceed 64bytes~
CloudConnexa obviously have their own solution.
Since I have read about the RFC3280: https://www.ietf.org/rfc/rfc3280.html#:~:text=ub-common-name-length%20integer%20%3A%3A%3D RFC5280: https://www.ietf.org/rfc/rfc5280.html#:~:text=ub-common-name-length%20integer%20%3A%3A%3D and related https://github.com/notaryproject/notary/issues/914
And if I issue a certificate with a common name longer than 64 bytes, easy-rsa will fail with an error
but your
CloudConnexa
of OpenVPN allows a common name to exceed 64 bytesIs there any magic in easy-rsa ?