This chapter has helped to illustrate some of the inner workings of the X.509 standard. My goal was to demystify certificate chains and the revocation list by providing tools and real-world command examples and allowing an OpenVPN administrator to identify connection and authentication problems.
Due to some limitations of how OpenVPN implemented these standards, useful clues are not always present in the client-side logs. Some of the most common and difficult-to-diagnose problems have been identified with solutions or explanation of how the logic is executed within the OpenVPN binary.
