How do I configure multiple users to use the same Client VPN endpoint?

Resolution

To configure multiple users to use the same Client VPN endpoint, complete the following steps:

1. Create a Client VPN endpoint.

2. To generate a unique client-side certificate for each user, run the following commands:

   ./easyrsa build-client-full user1.example.com nopass 
   ./easyrsa build-client-full user2.example.com nopass 

   Note: Replace user1 and user2 with your user information. Run the command for every user that you want to access the endpoint.

3. To retrieve the contents of the certificate (.crt) files for your users, run the following commands:

   sudo cat user1.example.com.crt            
   sudo cat user2.example.com.crt

4. To retrieve the contents of the key files for your users, run the following commands:

   sudo cat user1.example.com.key            
   sudo cat user2.example.com.key

5. Add the raw content of the .crt and .key files to each of the users in the Client VPN configuration files. Users store this file locally. Use the <cert></cert> and <key></key> identifiers directly following the </ca> line within the Client VPN configuration file. Or, specify the .crt and .key file paths, as shown in the following example:

   cert /Users/username/Downloads/*.crt    
   key /Users/username/Downloads/*.key

   Note: Replace username with your client's username. If the .crt and .key file isn't located in /Users/username/Downloads, then update the path.

6. Save the configuration files. Then, provide the files to each user to use to connect to the Client VPN endpoint.

After you connect to the Client VPN endpoint, complete the following steps:

1. Open the Amazon Virtual Private Cloud (Amazon VPC) console.
2. In the navigation pane, under Virtual private network (VPN), choose Client VPN endpoints.
3. Select the Client VPN endpoint.
4. Choose the Connections tab, and then choose Common name. You can see the TLS certificates on the tab. The certificates begin with each user's name.
5. (Optional) Configure client certificate revocation lists (CRLs) to block or revoke access to specific client certificates. If you add a client's certificate to a CRL, then Client VPN revokes the client's access to the endpoint.

Related information

Mutual authentication in AWS Client VPN