24.7.1 issue with importing CA and Certificate

ita.tc · August 15, 2024, 09:11:00 AM

We're having trouble with importing certificates on 24.7.1:
While trying to set up a site to site OpenVPN we created a CA and certificate on firewall A and exported those as usual.
We then imported the CA and then the certificate on firewall B, but the certificate shows up as "self signed" and trying to use it in an OpenVPN instance leads to an error (Unable to locate a CA for this certificate.).

If I reproduce these exact same steps on an older opnsense (I used one on 22.7.11 that I have for reference) the certificate is correctly linked to the CA.

Is this a known issue in 24.7? Do we need to do something differently than before?

netnut · August 15, 2024, 07:32:18 PM

Quote from: ita.tc on August 15, 2024, 09:11:00 AM
...
Do we need to do something differently than before?

Is it possible to paste your CA and Server certificate here ? (just the certs, _NOT_ the keys). Something like:

Code Select

openssl x509 -in /path/to/cert.pem -noout -text

If you don't want to share the actual certs, you could make an _exact_ dummy with bogus names, just replicate the other settings 100%.

ita.tc · August 19, 2024, 03:18:53 PM

Hi netnut,
thank you for your reply and excuse my late response. Sadly we noticed this bug with two firewalls that needed to be deployed, so we had to roll back to 24.1.
I have just installed two new 24.7 opnsenses and could recreate the issue. Here's the certificate data:

CA Cert:

Code Select

Test-Cert

Code Select

netnut · August 19, 2024, 10:32:40 PM

Quote from: ita.tc on August 19, 2024, 03:18:53 PM
...
I have just installed two new 24.7 opnsenses and could recreate the issue. Here's the certificate data:

Interesting, did you apply the minor patches too (24.7.1 is latest) ? The Trust module in 24.7 got a major rewrite and somewhere in time (don't know exact version) OpenSSL was upgraded from v1.x to v3.x.

I guess you created the original set of certificates (CA + Client) on a previous version, because when I try to reproduce your scenario with 24.7.1 the first thing that's noticeable is that the new OPNsense Trust module automatically creates certificates (client, server and client/server) with the IPsec OID (1.3.6.1.5.5.8.2.2) added to the "Extended Key Usage". These are missing in your example, so I'm wondering how you recreated this issue on 24.7 ?

Another important thing is that your example Client Certificate (Test-Cert) only contains a Common Name (CN) but no Subject Alternative Names (SAN), for a Client Certificate this could be a DNS Domain Name or Email Address, for a Server Certificate a DNS Domain Name. Modern crypto libraries (like OpenSSL v3) won't honor the CN anymore, just the SAN.

Some other things I noticed, but shouldn't be that important or part of your issue:

- Any reason you still using RSA, in most cases EC is more efficient? Secp521r1 for your CA, Secp384r1 for Client/Server.
- You could skip the email address in the subject, isn't used and makes the subject more "readable". At a minimum have a Subject with a Country, Organization and a Common Name.

Not only for importing your Certs in OPNsense, but for the sake of generic certificate hygiene I suggest you create a new certificate hierarchy within OPNsense. For your reference, here are a full CA and Client/Server certificate _with_ RSA keys which are created with (nothing special) and correctly related in OPNsense 24.7.1 :

CA

Code Select

Client/Server

Code Select

fgerardi · August 20, 2024, 11:31:46 AM

I probably have the same issue...apparently couldn't import new crl certificate anymore (I opened a separate post for this...). I tried to delete the imported CA and then tried to reimport it without success...I get the following error in the logs:

[OPNsense\Trust\Cert:cert.cb6ce1a9-1a7c-4b36-b203-746c5fb5906a.caref] Please select a valid certificate from the list{66c460d82d748}

My External CA is RSA based size 2048 bits.

Any ideas?

some-random-user · August 20, 2024, 01:19:17 PM

Quote from: netnut on August 19, 2024, 10:32:40 PM
Code Select Expand
-----BEGIN PRIVATE KEY----- MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC4KZ76AUrcCCTl [---8<---] g5wIHmFhEye+z7hW2BRr/2pVe3Sy7g== -----END PRIVATE KEY-----

Please don't do that. Someone will turn around and copy-paste it and use it. :(

ita.tc · August 20, 2024, 04:42:00 PM

Thank you for your input, netnut. You are right, those two certs where indeed created on 24.7.0 the original issue ocurred on a fully patched system with 24.7.1 installed on both firewalls.
I have updated my test system, deleted both certificate and CA and created new ones. But after import on the second firewall the certificate is still listed as self-signed and trying to use it in an openVPN instance leads to the aforementioned error "Unable to locate a CA for this certificate". The exact same thing happens, when I import the certificates you provided.

As for your other points: I'm thankful for your input and will bring this up internally. Sadly I don't have as much time for research and development as I once did so I appreciate you taking your time to educate me.

For Reference the newly created certificate (still RSA ;)):

CA:

Code Select

Certificate

Code Select

netnut · August 20, 2024, 09:55:17 PM

Quote from: some-random-user on August 20, 2024, 01:19:17 PM
Please don't do that. Someone will turn around and copy-paste it and use it. :(

You did noticed these are dummies, did you ?

Quote from: ita.tc on August 20, 2024, 04:42:00 PM
As for your other points: I'm thankful for your input and will bring this up internally. Sadly I don't have as much time for research and development as I once did so I appreciate you taking your time to educate me.

It's an interesting issue @ita.tc, busy with some stuff so will look into it further end of week. I really like what's being done with the new Trust module, the old one did have some other issues which are polished out.
After the 24.7 upgrade I didn't look that long at the Trust module, just checked if all existing certs were still OK, but I'm really interested what's causing this, to be continued...

ita.tc · August 21, 2024, 09:01:11 AM

Thank you for your efforts! I hope this gets fixed soon. As long as this issue persists we won't be using 24.7.
I also noticed that the way to export certificates was "better" before. You need extra clicks now and you have to name the files yourself. It's way more cumbersome in 24.7

fgerardi · August 21, 2024, 06:31:03 PM

In my honest opinion the certificate management is now a total mess...

driver99 · September 10, 2024, 01:53:11 PM

I am also having issues importing a third party certificate to OPNSense so that I can use it for the Webgui. My current certificate expired, and I tried to replace it but no joy. I generated a CSR using the Trusts/Certificates + method and then provided the CSR to the third party (Digicert). I then tried to add the code from resultant generated certificate when I tried to 'Sign a CSR'. Applying this to the Webgui crashed the front end and I had to reset it from the shell to get back in. Has anyone else had success in adding a third party certificate and applying it to the webgui?

Versions
OPNsense 24.7.3_1-amd64
FreeBSD 14.1-RELEASE-p3
OpenSSL 3.0.14

JBBERLIN · September 10, 2024, 03:31:35 PM

I have just created a CSR, uploaded it to the DigiCert site and the response CRT cannot be saved, the private key is also missing in the Config. If this is the case, 300 EUR are gone.

I have a closing </priv> tag in the config but the starting one is missing <priv>

EDIT: After a few tests I can confirm that OPNsense no longer generates private keys when creating a CSR. This is of course stupid if you have always made it easy for yourself and let the OPNsense generate the private keys.

driver99 · September 10, 2024, 05:58:54 PM

So it looks like certificates in general is pretty broken now.. not ideal for a security solution! Glad it's not just me, it's had me tearing my hair out trying to get a cert installed. Usually a super simple process, request it and upload it, job done.

Is this being looked at I wonder?

doktornotor · September 10, 2024, 06:10:29 PM

I would suggest filling an issue at GitHub.

newsense · September 11, 2024, 01:04:34 AM

I would wait for 24.7.4 - which is due in the next ~48 hours - and try again. There's been a bit of work in this space.

24.7.1 issue with importing CA and Certificate

ita.tc

August 15, 2024, 09:11:00 AM

netnut

August 15, 2024, 07:32:18 PM #1

ita.tc

August 19, 2024, 03:18:53 PM #2

netnut

August 19, 2024, 10:32:40 PM #3

fgerardi

August 20, 2024, 11:31:46 AM #4

some-random-user

August 20, 2024, 01:19:17 PM #5

ita.tc

August 20, 2024, 04:42:00 PM #6

netnut

August 20, 2024, 09:55:17 PM #7

ita.tc

August 21, 2024, 09:01:11 AM #8

fgerardi

August 21, 2024, 06:31:03 PM #9

driver99

September 10, 2024, 01:53:11 PM #10 Last Edit: September 10, 2024, 01:54:43 PM by driver99

JBBERLIN

September 10, 2024, 03:31:35 PM #11 Last Edit: September 10, 2024, 03:43:47 PM by JBBERLIN

driver99

September 10, 2024, 05:58:54 PM #12

doktornotor

September 10, 2024, 06:10:29 PM #13

newsense

September 11, 2024, 01:04:34 AM #14