Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When I make a certificate like so

cd /etc/openvpn/easy-rsa/2.0/
source ./vars
. /etc/openvpn/easy-rsa/2.0/build-key client1

Then commonName is set to client1.

When I ask the OpenVPN server what the commonName is of the user who is connected, can I then trust, that the user haven't altered his commonName in the certificate?

Update

I have tried to change all the clear text in the crt file on both the client and server, but the certificate still works and the OpenVPN server still replies with the proper commonName and Subject.

This certificate still works, where I have altered all plain text. I have removed the actual certificate for security reasons.

If commonName and Subject isn't extracted from the plain text. Where does OpenVPN then gets them from?

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5 (0x5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=X, ST=X, L=X, O=X, OU=X, CN=X CA/name=X/emailAddress=X@X.X
        Validity
            Not Before: Jan 12 12:53:47 2012 GMT
            Not After : Apr 11 12:53:47 2012 GMT
        Subject: C=X, ST=X, L=X, O=X, OU=X, CN=X/emailAddress=X@X.X
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:a5:40:a0:e4:44:3e:27:4c:13:69:03:a7:c3:38:
                    4f:dc:43:dc:fb:f5:43:c8:5b:50:8b:7f:0d:f4:d8:
                    30:00:e0:e3:f7:75:1c:3b:e2:08:95:8e:31:cf:a7:
                    6f:e2:94:f4:4d:7c:c4:11:a9:a5:84:1b:95:2b:9a:
                    93:da:ad:34:ae:df:5d:9d:0a:18:b3:df:86:c1:f6:
                    fb:fe:d8:16:64:a9:bf:91:51:8a:54:ba:26:5a:b4:
                    6a:88:c3:52:a7:fa:86:39:08:20:c1:53:3d:f3:12:
                    e1:50:37:11:16:db:99:53:02:82:6f:a0:05:9f:23:
                    ff:bf:79:93:1c:ef:1e:4e:31
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                Easy-RSA Generated Certificate
            X509v3 Subject Key Identifier: 
                89:E7:7A:9B:1F:72:15:91:BD:D0:F4:67:A8:A1:C3:E0:0D:B1:3A:B3
            X509v3 Authority Key Identifier: 
                keyid:75:A6:F1:68:88:53:F5:9B:14:4A:67:00:0B:58:7C:38:1C:A0:A1:F8
                DirName:/C=X/ST=X/L=X/O=X/OU=X/CN=X CA/name=X/emailAddress=X@X.X
                serial:80:D1:56:33:4C:5D:6D:57

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 Key Usage: 
                Digital Signature
    Signature Algorithm: sha1WithRSAEncryption
        9c:a5:2b:a8:cf:86:60:90:f3:45:80:78:30:89:6a:56:cc:09:
        e8:a4:75:25:af:04:52:8f:15:7b:cd:87:94:f3:c4:2f:99:3f:
        b5:51:f7:e1:de:96:92:ae:0a:77:9e:1f:fb:8a:c3:de:84:3c:
        bb:4f:7f:f1:67:af:0c:1e:b0:90:2c:de:63:f8:47:89:f5:7b:
        57:fe:e4:8d:1d:1e:62:19:27:99:83:99:9f:4d:08:ef:b6:b4:
        7d:56:5d:ca:39:fd:1c:f3:15:6a:da:bc:51:ca:ad:59:7c:af:
        77:72:3c:ca:e7:dc:74:bc:c0:de:2e:f7:b2:27:1b:a7:ae:02:
        0f:9c
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

The plain text at the beginning of your crt file is there for informational purposes only. All it does is present in human readable form the contents of the Base64 encoded certificate that follows. The informational text is ignored by most PKI software.

share|improve this answer
add comment

The "Common Name" is part of a X.500 name; here, the one called "SubjectDN", which designates the owner of the public key which is contained in the certificate. That name is part of the certificate, in the part which is covered by the signature; as such, it is exactly as trustworthy as any other element in the certificate.

share|improve this answer
    
Very interesting. I have tried to change all plain text, but the certificate still works and OpenVPN still reports the correct commonName and Subject. How can that be? –  Sandra Schlichting Feb 10 '12 at 21:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.