No VPN connection with CRL enabled after upgrade to 22.7

[coolmint]

Using the OpenVPN Server with the Peer Certificate Revocation List option, the following error is shown in the Log file and no client can authenticate:

'CRL: cannot read CRL from file /var/etc/openvpn/server1.crl-verify'

If I deactivate the CRL-Option in the server settings by setting it to 'none', Clients can connect again without problems.

[tuto2]

Hi,

Can you try

Code: [Select]

# opnsense-patch 2918f0e24And see if this fixes it for you?

Edit: I should you mention you need to regenerate the relevant CRL in order for this change to be picked up.

Cheers,
Stephan

[franco]

Posting patch link here for reference: https://github.com/opnsense/core/commit/2918f0e24

[coolmint]

Thank you for your reply, I tried the patch and regenerated the CRL but no luck.

The error is still the same.

Edit:

Additional there is a new error shown in the Log:

'OpenSSL: error:0909006C:PEM routines:get_name:no start line'

[tuto2]

If you open the CRL file, is there anything malformed in there such as stray newlines, carriage returns, missing dashes etc.? At least the OpenSSL error sees to hint at that.

[coolmint]

The system generated the 'server1.crl-verify' file as a zero-byte file.
I don't have any revoked certificates at the moment, so I expected an empty file as well.

Should the file contain data, even without revoked certificates?

[franco]

Yes, it should and that's why it fails. Can you try adding a certificate for testing purposes? (It can be removed again with no harm to the CRL.)


Cheers,
Franco

[franco]

I tried but couldn't produce an empty file with an empty revocation list. It properly generates a CRL file as it should.


Cheers,
Franco

[Fright]

the only way i can reproduce "OpenSSL: error:0909006C" with zero-size .crl-verify is creating Revocation for External CA (without priv key) and adding it as a "Peer Certificate Revocation List" in openvpn server config
(it might be worth taking this into account (creating (not importing) a Revocation list for CA without the private key) when validating?)

[coolmint]

Weird bevavior - if I revoke a certificate via GUI the timestap of the file changes to the current date and time but the file itself remains empty.

The content of the '/var/etc/openvpn' directory is shown as follows:

Code: [Select]

-rw-------  1 root  wheel   956B Aug  6 10:35 server1.ca
-rw-------  1 root  wheel   1.2K Aug  6 10:35 server1.cert
-rw-------  1 root  wheel   1.3K Aug  6 10:35 server1.conf
-rw-------  1 root  wheel     0B Aug  6 10:35 server1.crl-verify
-rw-------  1 root  wheel   227B Aug  6 10:35 server1.key
srwxrwxrwx  1 root  wheel     0B Aug  6 10:35 server1.sock
-rw-------  1 root  wheel   636B Aug  6 10:35 server1.tls-auth
I can do whatever I want, the only thing that changes regarding the 'server1.crl-verify' file is the timestamp. 

[Fright]

Is the CA for this list internal or external (is the private key of this authority specified)?

[coolmint]

The CA is internal with a self-signed certificate and the certificate private key exists in the CA properties.

For testing purposes I created a completely new CA with a corresponding CRL.
Using the new setup, the behavior is still the same - the system creates a zero-byte '.crl-verify' file.

[Fright]

thanks!
i think validateSignature() can return mixed value and should be checked differently
https://github.com/opnsense/core/blob/edcc29ab5cdc5c6e8ea9a656a13ffdfb1ec67db7/src/etc/inc/certs.inc#L638
i'll try to check.. <- my mistake

[Fright]

@coolmint

Using the new setup, the behavior is still the same - the system creates a zero-byte '.crl-verify' file.

any chance that you forgot to change "Peer Certificate Revocation List" in openvpn server config? )

if you are willing to help sort out the reasons, can you try again (create a CRL and add a certificate to it) after:

Code: [Select]

opnsense-patch -a kulikov-a 91e13ae ?

any errors adding cert to CRL? is CRL valid if you download via GUI? any errors in General log?

[coolmint]

@coolmint

Using the new setup, the behavior is still the same - the system creates a zero-byte '.crl-verify' file.

any chance that you forgot to change "Peer Certificate Revocation List" in openvpn server config? )

That would have been nice, but no - I changed both, the new Peer Certificate Authority and the Peer Certificate Revocation List in the VPN server configuration before testing.

if you are willing to help sort out the reasons, can you try again (create a CRL and add a certificate to it) after:

Code: [Select]

opnsense-patch -a kulikov-a 91e13ae ?

any errors adding cert to CRL? is CRL valid if you download via GUI? any errors in General log?

I applied the patch, created a new CA, a new Cert and a CRL (and adjusted the VPN-Server config).

If I now try to revoke the Cert, I get the follwoing message:

Code: [Select]

Cannot revoke certificate. See general log for details.

The general log shows:

Code: [Select]

2022-08-07T20:18:43 Error opnsense Cert revocation error: CRL validation failed at first step.

The '.crl-verify' file still remains empty.
I can export the CRL file (no errors are shown here) and open it (it's - as expected - empty).