Stanislas df242ee069 feat: add peer-fingerprint authentication mode (OpenVPN 2.6+) (#1437) ...

## Summary

Implements support for OpenVPN's `--peer-fingerprint` option, enabling
PKI-less authentication using SHA256 certificate fingerprints instead of
a CA chain.

Closes #1361

## Changes

- Add `--auth-mode` option (`pki` or `fingerprint`) for install command
- Use Easy-RSA's `self-sign-server` and `self-sign-client` commands for
fingerprint mode
- Server stores client fingerprints in `<peer-fingerprint>` block in
`server.conf`
- Clients verify server using `peer-fingerprint` directive instead of CA
- Revocation removes fingerprint from config and reloads OpenVPN
(instant effect)
- Version check ensures OpenVPN 2.6+ when fingerprint mode is selected

## Usage

```bash
# Interactive mode prompts for auth mode choice

# CLI mode
./openvpn-install.sh install --auth-mode fingerprint
```

## Comparison

| Aspect | PKI Mode | Fingerprint Mode |
|--------|----------|------------------|
| Server cert | CA-signed | Self-signed |
| Client cert | CA-signed | Self-signed |
| Revocation | CRL-based | Remove fingerprint |
| OpenVPN | Any version | 2.6.0+ required |
| Best for | Large deployments | Small/home setups |

2025-12-18 17:20:28 +01:00

..

linters

chore(deps): update super-linter/super-linter action to v8 (#1339)

2025-12-11 11:12:00 +01:00

workflows

feat: add peer-fingerprint authentication mode (OpenVPN 2.6+) (#1437)

2025-12-18 17:20:28 +01:00

FUNDING.yml

Update FUNDING.yml

2022-01-31 01:36:28 +01:00

issue_template.md

Update issue template

2023-01-21 23:18:52 +01:00

pull_request_template.md

Update pull request template to clarify maintenance burden of added features

2025-12-09 14:17:19 +01:00