Rework certificate parts. Use different client certificates.

Reshape and reword configuration file.

gp-okta.conf

@@ -1,38 +1,49 @@
+# --- general
 debug = 0
-
-vpn_url = https://vpn.example.com
-#vpn_url_cert = vpn_url.cert
-
 okta_url = https://example.okta.com
-#okta_url_cert = okta_url.cert
+vpn_url = https://vpn.example.com
 
-#gateway = NEWYORK1-GW                 # optional gateway name to choose
-#gateway_url = https://ny1-gw.my.lan   # optional gateway url to authenticate
-another_dance = 0                      # second round of authentication
+# "gateway_url" forces authentication with specific gateway.
+#gateway_url = https://ny1-gw.my.lan
+# "another_dance" (0/1) defines whether to do second authentication, i.e.,
+# after authentication with portal, do another authentication with gateway.
+#another_dance = 0
 
 username = myuser
 password = mypass
-#client_cert = path-to-myusers-client-cert-as-unencrypted-pem-file.pem
+# "gateway" is a preferred gateway selection, which portal asks for.
+gateway = NEWYORK1-GW
 
-#openconnect_certs = path-to-a-writeable-filename-in-which-the-script-will-collect-all-involved-server-certs-if-not-set-a-temp-file-is-used-instead
-
-# mfa_order = totp sms
-sms.okta = 0
+# --- multi-factor authentication
+#mfa_order = totp sms
+#sms.okta = 0
 #totp.okta = ABCDEFGHIJKLMNOP
 #totp.google = ABCDEFGHIJKLMNOP
 #totp.symantec = ABCDEFGHIJKLMNOP
 
-execute = 0                           # execute openconnect command
-openconnect_cmd = sudo openconnect    # command to run openconnect
-openconnect_args =                    # optional arguments to openconnect
-
-# "openconnect_fmt" is automatically detected by running "openconnect_cmd" -V
-# otherwise, it can be manually formatted what exactly pipe to openconect:
-# - supports <cookie>, <gateway_name>, etc
-# - other characters are provided as-is
+# --- certificates
+# "certs" is (optional) path to certificate file, which will be overwritten
+# and stored with all certificates encountered (in config and portal data).
+# by default, "certs" is not specified, so a temporary file will be created.
 #
-# - for openconnect 8.05+
-#openconnect_fmt = <cookie><gateway_name><cookie>
-# - for openconnect 8.00 - 8.04
-#openconnect_fmt = <cookie><gateway_name>
+# any "*_cert" is (optional) path to readable and unencrypted certificate
+# file, which will be appended to "certs". four specific settings exists:
+# "vpn_url_cert" and "okta_url_cert" are used to verify relevant URLs.
+# "vpn_cli_cert" and "okta_cli_cert" are used as client certificate.
+#
+#certs = certs.pem
+#vpn_url_cert = vpn.pem
+#okta_url_cert = okta.pem
+#vpn_cli_cert = vpn_cli.pem
+#okta_cli_cert = okta_cli.pem
+
+# --- execution
+# "execute" (0/1) defines if openconnect (as specified with "openconnect_cmd"
+# and "openconnect_args") is executed after OKTA authentication dance.
+execute = 0
+openconnect_cmd = sudo openconnect
+openconnect_args =
+# "openconnect_fmt" is manually specified format what to pipe to openconect.
+# supports <cookie>, <username>, etc. other characters are provided as-is
+#openconnect_fmt = <cookie><cookie>