Messages

Works fine :D To me that button looked like a "refresh" button (for just refreshing the web UI). Feeling stupid now m) Thank you!

Whoohoo, fixed by AdSchellevis in https://github.com/opnsense/core/commit/67f49486708770633ca615ee41f53439e0a962ce and scheduled for 19.1.2 by franco :D

Nope, I didn't. Never noticed this kind of button before :) Is it an "Apply" button (which is labelled "Apply" in other places)?! Doesn't show a mouseover description :(

Seems there was already a github issue for this problem which should be reopened: https://github.com/opnsense/core/issues/1487

@newsense You don't seem to understand the basics here and I don't have the time and energy to explain (sorry about that). I'd recommend to read the documentation about the Certificate Depth option (or the OpenVPN --tls-verify option).

Hi!

It seems that /usr/local/etc/nginx/nginx.conf is only rewritten/updated upon disabling+re-enabling the nginx service.

I added an HTTP server and a Location, but no server {} entry was visible in nginx.conf, even after re-starting the service.

Only after I disabled and re-enabled the service, the nginx.conf was rewritten/updated and contains the configured server {} entry.

I consider this a bug?

Cheers,
Wolfram

See my initial posting :)

The openvpn server process is using a single CA (namely the "VPN CA"), not the full local CA chain:

Code Select Expand


[root@opnsense ~]# ps auxwwf | grep [o]penvpn
root    28509   0.0  0.2 1062000  7576  -  Ss   07:04       0:00.09 /usr/local/sbin/openvpn --config /var/etc/openvpn/server1.conf
[root@opnsense ~]# grep '^ca' /var/etc/openvpn/server1.conf
ca /var/etc/openvpn/server1.ca
[root@opnsense ~]# grep 'BEGIN CERTIFICATE' /var/etc/openvpn/server1.ca | wc -l
       2
[root@opnsense ~]# /usr/local/bin/openssl x509 -in /var/etc/openvpn/server1.ca -noout -subject
subject= /C=xxx/ST=xxx/L=xxx/O=xxx/emailAddress=xxx/CN=VPN CA
[root@opnsense ~]#


I consider this a (very annoying) bug in OPNsense, as the OpenVPN configuration logic should be intelligent enough to resolve the full local CA chain.

It's unchanged, obviously.

I'm talking about *server* log/error messages, not *client* ones.
The server complains that it cannot verify the client certificate.

Hi!

I have created the following setup:

1. Created "Root CA" using the OPNsense trust manager
2. Created "Server CA" as intermediate of Root CA using the OPNsense trust manager
3. Created "VPN CA" as intermediate of Root CA using the OPNsense trust manager
4. Generated a server certificate "Server Cert" signed by "Server CA" using the OPNsense trust manager
5. Created an OpenVPN server using the wizard with the following settings:
5.1. Server Certificate: "Server Cert"
5.2. Peer Certificate Authority: "VPN CA"
5.3. Certificate Depth: "Do Not Check"
5.4. Strict User/CN Matching: (x)
6. Created a user "vpnuser" with a client certificate issued by "VPN CA"
7. Created an OpenVPN client export for the "vpnuser"

Then, I when I try to connect from the client, the server complains that it cannot verify an issuer certificate:

Code Select Expand


Feb 12 20:52:41 openvpn[16478]: CLIENT_IP:20435 TLS Error: TLS handshake failed
Feb 12 20:52:41 openvpn[16478]: CLIENT_IP:20435 TLS Error: TLS object -> incoming plaintext read error
Feb 12 20:52:41 openvpn[16478]: CLIENT_IP:20435 TLS_ERROR: BIO read tls_read_plaintext error
Feb 12 20:52:41 openvpn[16478]: CLIENT_IP:20435 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Feb 12 20:52:41 openvpn[16478]: CLIENT_IP:20435 VERIFY ERROR: depth=1, error=unable to get issuer certificate: C=xx, ST=xxx, L=xxx, O=xxx, emailAddress=xxx, CN=VPN CA


The strange workaround, according to two other existing threads in this forum (https://forum.opnsense.org/index.php?topic=9888.0 and https://forum.opnsense.org/index.php?topic=4830.0), is to manually append the "Root CA" certificate data at the end of the "VPN CA" certificate data in the OPNsense trust manager.

That should not be required! OPNsense should configure OpenVPN to use the entire local CA certificate chain.

Cheers,
Wolfram

Hi!

When running the OPNsense VGA installer (OPNsense-19.1-OpenSSL-vga-amd64.img.bz2) on a Sophos XG115 Rev 2, I can see the console output on the VGA display until the line "Booting...".
From there on, all console output is only displayed on the serial port.

I thought the VGA version of OPNsense should be using VGA-only and the serial port not at all...?

Cheers,
Wolfram

According to https://github.com/pcengines/apu2-documentation/blob/master/docs/pfSense-install-guide.md the issue (which affects only mainline BIOS versions, not legacy 4.0.x) is solved in mainline BIOS versions *after* 4.6.7 (latest one currently is 4.9.0.1).

The installation of OPNsense 19.1 worked well using mainline BIOS 4.9.0.1 on my APU4C4 (which just arrived this week with BIOS 4.6.1 flashed, meh).