summaryrefslogtreecommitdiff
path: root/sample/sample-config-files/client.conf
diff options
context:
space:
mode:
Diffstat (limited to 'sample/sample-config-files/client.conf')
-rw-r--r--sample/sample-config-files/client.conf17
1 files changed, 9 insertions, 8 deletions
diff --git a/sample/sample-config-files/client.conf b/sample/sample-config-files/client.conf
index 58b2038..050ef60 100644
--- a/sample/sample-config-files/client.conf
+++ b/sample/sample-config-files/client.conf
@@ -89,18 +89,19 @@ ca ca.crt
cert client.crt
key client.key
-# Verify server certificate by checking
-# that the certicate has the nsCertType
-# field set to "server". This is an
-# important precaution to protect against
+# Verify server certificate by checking that the
+# certicate has the correct key usage set.
+# This is an important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
-# your server certificates with the nsCertType
-# field set to "server". The build-key-server
-# script in the easy-rsa folder will do this.
-ns-cert-type server
+# your server certificates with the keyUsage set to
+# digitalSignature, keyEncipherment
+# and the extendedKeyUsage to
+# serverAuth
+# EasyRSA can do this for you.
+remote-cert-tls server
# If a tls-auth key is used on the server
# then every client must also have the key.