Any chance to get "OpenVPN Connect v3" work with the OPNsense VPN server?

[tbarth]

Hi,
I ve configured VPN on OPNsense and I do get successful VPN connections with the clients "openvpn" on Debian 10 and "OpenVPN GUI 2.x" on Win 11. As Win 10 refuses to install OpenVPN GUI 2.x I tried to use the newer client version "OpenVPN Connect v3" on my Win10 pc. But I get the error "EPKI_ERROR External Certificate Signing Failed". Here is the connecting log:

Code: [Select]

[Dec 6, 2022, 12:39:33] OpenVPN core 3.git::d3f8b18b win x86_64 64-bit built on Mar 17 2022 11:42:02
[Dec 6, 2022, 12:39:33] Frame=512/2048/512 mssfix-ctrl=1250
[Dec 6, 2022, 12:39:33] UNUSED OPTIONS
1 [persist-tun]
2 [persist-key]
6 [resolv-retry] [infinite]
8 [lport] [0]
13 [pkcs12] [my_p12_file.p12]
[Dec 6, 2022, 12:39:33] EVENT: RESOLVE
[Dec 6, 2022, 12:39:33] Contacting my_server_ip:1194 via UDP
[Dec 6, 2022, 12:39:33] EVENT: WAIT
[Dec 6, 2022, 12:39:33] WinCommandAgent: transmitting bypass route to my_server_ip
{
"host" : "my_server_ip",
"ipv6" : false
}

[Dec 6, 2022, 12:39:33] Connecting to [my_server_ip]:1194 (my_server_ip) via UDPv4
[Dec 6, 2022, 12:39:33] EVENT: CONNECTING
[Dec 6, 2022, 12:39:33] Tunnel Options:V4,dev-type tun,link-mtu 1602,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client
[Dec 6, 2022, 12:39:33] Creds: UsernameEmpty/PasswordEmpty
[Dec 6, 2022, 12:39:33] Peer Info:
IV_VER=3.git::d3f8b18b
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1
IV_GUI_VER=OCWindows_3.3.6-2752
IV_SSO=webauth,openurl,crtext

[Dec 6, 2022, 12:39:33] EVENT: EPKI_ERROR External Certificate Signing Failed
[Dec 6, 2022, 12:39:33] Client exception in transport_recv_excode: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:0406B07A:rsa routines:RSA_padding_add_none:data too small for key size / error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib
[Dec 6, 2022, 12:39:33] EVENT: DISCONNECTED

One year ago a user asked the same question in the openvpn forum, but yet no solution => https://forums.openvpn.net/viewtopic.php?t=32717.

Is there any chance to get the Connect-Client work with VPN on OPNsense? If not, isn't it about time that both teams OPNsense and OpenVPN communicate with each other to fix this problem?

[robaldo]

I have the V3 Client running with the Opnsense.

Using a AES-256-cbc (256 bit key,128 bit block) Encryption algorithm

Auto Digest is a SHA 256.

I need to Import the Certificate from the Opensens to get the client running not only the Client Certificate

that was a "POC" if this works. But I'm not shure if I want to role it out to the Client ...