title: How to extract client certificate info from OpenVPN?
body: <p>When a user is connected to my OpenVPN server would I like to extract the ID of the clients certificate.</p>
  
  <p>The purpose is to write a script that will prevent users from sharing their certificates with others. Right now any certificate will work with any valid LDAP user.</p>
  
  <p>When I set <code>script-security 3</code>, which seams to give the most info to the <code>env</code> variable, I see the variables at the bottom of this post (actual values removed). As far as I can tell, nothing in there can be tied to the certificate the user used.</p>
  
  <p><strong>Question</strong></p>
  
  <p>How do I get hold of the client's certificate/key ID, so I can match it against <code>/etc/openvpn/easy-rsa/2.0/keys/*{.crt,.csr,.key}</code>? The filename is the LDAP username.</p>
  
  <p>E.g.</p>
  
  <pre><code>/etc/openvpn/easy-rsa/2.0/keys/bob.crt
  /etc/openvpn/easy-rsa/2.0/keys/bob.csr
  /etc/openvpn/easy-rsa/2.0/keys/bob.key
  </code></pre>
  
  <p>Dump of <code>env</code> variable</p>
  
  <pre><code>X509_1_OU=
  common_name=
  route_gateway_1=
  ifconfig_remote=
  untrusted_ip=
  ifconfig_local=
  proto_1=
  tls_serial_1=
  tls_serial_0=
  tun_mtu=
  X509_1_emailAddress=
  tls_id_0=
  X509_1_L=
  tls_id_1=
  X509_1_O=
  password=
  script_type=
  verb=
  username=
  local_port_1=
  config=
  X509_0_CN=
  dev=
  auth_control_file=
  X509_1_C=
  X509_1_ST=
  route_network_1=
  remote_port_1=
  PWD=
  route_net_gateway=
  daemon=
  X509_1_name=
  untrusted_port=
  SHLVL=
  script_context=
  route_vpn_gateway=
  route_netmask_1=
  daemon_start_time=
  X509_0_ST=
  daemon_pid=
  X509_1_CN=
  X509_0_OU=
  X509_0_emailAddress=
  daemon_log_redirect=
  X509_0_C=
  X509_0_L=
  link_mtu=
  X509_0_O=
  </code></pre>