openvpn: Fix certificate verification compatibility

docs/configuration/endpoint/openvpn-client.md

@@ -38,6 +38,8 @@
     "crl_path": "",
     "remote_certificate_ku": [],
     "remote_certificate_eku": "",
+    "remote_certificate_tls": "",
+    "certificate_profile": "",
     "version_min": "1.2",
     "version_max": "",
     "cipher": "",
@@ -251,15 +253,35 @@ Disabled by default.
 
 Required server certificate key usage masks, written as hexadecimal values in OpenVPN `remote-cert-ku` format.
 
-Multiple values are combined, and all requested usages must be present.
+The certificate must contain all bits from at least one configured mask.
 
 Disabled by default.
 
 ### tls.remote_certificate_eku
 
-Required server certificate extended key usage, one of `server` or `client`.
+Required server certificate extended key usage.
 
-Disabled by default. The standard OpenVPN server certificate usage check still applies.
+OpenSSL names, object identifiers, and the aliases `server` and `client` are accepted.
+
+When set, this field replaces the default `tls.remote_certificate_tls` check.
+
+Conflict with an explicitly configured `tls.remote_certificate_tls`.
+
+### tls.remote_certificate_tls
+
+Peer certificate purpose check, one of `server`, `client`, or `none`.
+
+`server` is used by default.
+
+`none` disables the certificate purpose check.
+
+Conflict with `tls.remote_certificate_eku`.
+
+### tls.certificate_profile
+
+Certificate profile, one of `insecure`, `legacy`, `preferred`, or `suiteb`.
+
+`legacy` is used by default.
 
 ### tls.version_min
 

docs/configuration/endpoint/openvpn-client.zh.md

@@ -38,6 +38,8 @@
     "crl_path": "",
     "remote_certificate_ku": [],
     "remote_certificate_eku": "",
+    "remote_certificate_tls": "",
+    "certificate_profile": "",
     "version_min": "1.2",
     "version_max": "",
     "cipher": "",
@@ -251,15 +253,35 @@ OpenVPN 控制通道 TLS 配置。
 
 服务器证书所需的 Key Usage mask，使用 OpenVPN `remote-cert-ku` 格式的十六进制值。
 
-多个值会被组合，证书必须包含所有要求的用途。
+证书必须包含至少一个已配置 mask 中的所有 bit。
 
 默认禁用。
 
 ### tls.remote_certificate_eku
 
-服务器证书所需的 Extended Key Usage，可选值为 `server` 或 `client`。
+服务器证书所需的 Extended Key Usage。
 
-默认禁用。标准 OpenVPN 服务器证书用途检查仍然生效。
+接受 OpenSSL 名称、Object Identifier 以及 `server` 和 `client` 别名。
+
+设置后，该字段会替代默认的 `tls.remote_certificate_tls` 检查。
+
+与显式配置的 `tls.remote_certificate_tls` 冲突。
+
+### tls.remote_certificate_tls
+
+对端证书用途检查，可选值为 `server`、`client` 或 `none`。
+
+默认使用 `server`。
+
+`none` 禁用证书用途检查。
+
+与 `tls.remote_certificate_eku` 冲突。
+
+### tls.certificate_profile
+
+证书 profile，可选值为 `insecure`、`legacy`、`preferred` 或 `suiteb`。
+
+默认使用 `legacy`。
 
 ### tls.version_min
 

docs/configuration/endpoint/openvpn-server.md

@@ -33,6 +33,7 @@
     "client_certificate": [],
     "client_certificate_path": "",
     "verify_client_certificate": "require",
+    "certificate_profile": "",
     "control_wrap": {
       "type": "tls_crypt",
       "key": [],
@@ -214,6 +215,12 @@ If set to `none`, client certificates are not requested.
 
 This field does not replace `users`; when `users` is set, username/password authentication is still required.
 
+### tls.certificate_profile
+
+Certificate profile, one of `insecure`, `legacy`, `preferred`, or `suiteb`.
+
+`legacy` is used by default.
+
 ### tls.control_wrap
 
 OpenVPN control channel wrapping.

docs/configuration/endpoint/openvpn-server.zh.md

@@ -33,6 +33,7 @@
     "client_certificate": [],
     "client_certificate_path": "",
     "verify_client_certificate": "require",
+    "certificate_profile": "",
     "control_wrap": {
       "type": "tls_crypt",
       "key": [],
@@ -214,6 +215,12 @@ OpenVPN 客户端证书策略，`require`、`optional` 或 `none` 之一。
 
 该字段不替代 `users`；设置 `users` 后仍然要求用户名/密码认证。
 
+### tls.certificate_profile
+
+证书 profile，可选值为 `insecure`、`legacy`、`preferred` 或 `suiteb`。
+
+默认使用 `legacy`。
+
 ### tls.control_wrap
 
 OpenVPN 控制信道包装。