I would like to prepare for the case that client certificates get expired and wondered if there's any option/hook one can use to tell OpenVPN to accept client certificates even if they have been expired?
Looking at the reference manual, I only found things which could be checked alternatively or additionally and then mostly after OpenVPN itself validated certificates already. But I can't find anything to tell that OpenVPN should do its normal certificate validation, but in case a certificate has been expired simply still allow it or optionally ask me by using some script.
–tls-verify cmd runs only after all other tests have passed already, but in case of an expired certificate things fail. The same seems to be the case for
-management-client-auth. Something like
–verify-client-cert none|optional|require sounds promising, but there simply doesn't seem to be the case I need. Using username+password wouldn't help my use case, because that would involve re-configuring lots of clients, in which case I could simply change certificates as well. I need something which relies on certificates but gives me some additional influence.
So is that possible at all currently? From what I've read it sounds like the answer is no. Thanks!