AWS Client VPN[Mutual authentication]を使用する

[AWS Client VPN[Federation authentication]を使用する](https://qiita.com/ldr/items/63b971a33edfcd93c9c9)ではiOSやAndroidでは使用できないので、OpenVPN Connect用に相互認証接続を作成する。

参照するリソースは[AWS Client VPN[Federation authentication]を使用する](https://qiita.com/ldr/items/63b971a33edfcd93c9c9)で作成したものを使用。

<details><summary>ec2_client_vpn_endpoint.tf</summary>

```hcl
data "aws_acm_certificate" "server" {
  domain      = "xxxxxx.com"
  statuses    = ["ISSUED"]
  most_recent = true
  types       = ["AMAZON_ISSUED"]
}

data "aws_acm_certificate" "client1" {
  domain      = "client1.domain.tld"
  statuses    = ["ISSUED"]
  most_recent = true
  types       = ["IMPORTED"]
  tags = {
    Authentication = "client-certificate-base"
  }
}

resource "aws_ec2_client_vpn_endpoint" "example_mutual_auth" {
  client_cidr_block = "192.168.16.0/22"
  description       = "use tcp"
  dns_servers = [
    "1.1.1.1",
    "8.8.8.8",
  ]
  self_service_portal    = "enabled"
  server_certificate_arn = data.aws_acm_certificate.server.arn
  split_tunnel           = false

  tags = {
    Name = "example-vpn-mutual-authentication"
  }

  transport_protocol = "tcp"

  authentication_options {
    root_certificate_chain_arn = data.aws_acm_certificate.client1.arn
    type                       = "certificate-authentication"
  }
  
  connection_log_options {
    enabled               = true
    cloudwatch_log_group  = aws_cloudwatch_log_group.client_vpn.name
    cloudwatch_log_stream = aws_cloudwatch_log_stream.client_vpn.name
  }
}

resource "aws_ec2_client_vpn_network_association" "example_mutual_auth_assoc" {
  for_each = var.vpn_client_nat_route_assoc

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example_mutual_auth.id
  subnet_id              = aws_subnet.client_vpn[each.key].id
  security_groups        = [aws_security_group.client_vpn_2.id]
}

resource "aws_ec2_client_vpn_authorization_rule" "example_mutual_auth_authorization" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example_mutual_auth.id
  target_network_cidr    = "0.0.0.0/0"
  authorize_all_groups   = true
}

resource "aws_ec2_client_vpn_route" "example_mutual_auth_route_1a" {

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example_mutual_auth.id
  destination_cidr_block = "0.0.0.0/0"
  target_vpc_subnet_id   = aws_subnet.client_vpn["private-1a"].id
}

resource "aws_ec2_client_vpn_route" "example_mutual_auth_route_1c" {

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example_mutual_auth.id
  destination_cidr_block = "0.0.0.0/0"
  target_vpc_subnet_id   = aws_subnet.client_vpn["private-1c"].id
}
```
</details>

クライアントVPNエンドポイント設定ファイルをダウンロードし、
```mutual-auth-config.ovpn
client
dev tun
proto tcp
remote cvpn-endpoint-xxxxxxxxxxxx.xxxxx.clientvpn.ap-northeast-1.amazonaws.com 443
remote-random-hostname
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
verb 3
<ca>
-----BEGIN CERTIFICATE-----
Amazon Root CA 1
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Starfield Services Root Certificate Authority - G2
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
Starfield Services Root Certificate Authority - G2
-----END CERTIFICATE-----
</ca>

<ca>
-----BEGIN CERTIFICATE-----
server_certificate_arnで指定している証明書
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
root_certificate_chain_arnで指定している証明書
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
server_certificate_arnで指定している証明書を作成した秘密鍵
-----END PRIVATE KEY-----
</key>

reneg-sec 0

verify-x509-name xxxxxx.com name
```

- AppStoreからOpenVPN Connectをインストールする
![名称未設定2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/651479e9-c8b3-a314-f175-a22b834acaea.png)

- ローカルマシンにiPhoneを接続し、ClientConfigrationをOpenVPN配下に置く
![スクリーンショット 2022-05-19 16.25.39.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/8981aacd-6f3e-95e5-2e7f-c3fe9e6cf1ca.png)

- OpenVPNを起動させ、設定ファイルを追加する
![名称未設定3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/41327168-f9d4-1d7b-ba6b-7ebbad93097a.png)

![名称未設定4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/e145b39e-5cf4-f9a1-5bbe-1f8ebd642e47.png)

- 接続する
![名称未設定5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/f8a85de1-5eb9-afa2-ac5a-90908b082c36.png)

![名称未設定6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/c5b272fb-0e9c-c461-3415-ae56987e3f11.png)