better handling "missing Client Authentication (1.3.6.1.5.5.7.3.2)"

[chipitsine]

I've encontered strange situation. people tried to use client certificates without "Client Authentication (1.3.6.1.5.5.7.3.2)"

it leads to

a) server refuses such cert b) client tries to reconnect (with no luck)

what I suggest is to think about better handling of such situations (either check certificate in openvpn-gui or openvpn itself of better handling such errors, i.e. not to reconnect)

[mattock]

If I recall correctly, the problem is that the GUI does not get fine-grained information from OpenVPN about the reason why a connection failed. Until that is fixed, fixing this particular problem can be tricky. @selvanair can probably elaborate on this topic.

[chipitsine]

I've looked through openvpn source code, as far as I understand, "Client Authentication (1.3.6.1.5.5.7.3.2)" is mandatory extension

if so, we can pre-check it before connection is ever established.

I agree that fine-grain information would be more helpful

[selvanair]

This is best discussed in openvpn-devel.