OpenVPN CLient Export fails with "Certificate does not belong to server CA"

[SchengFui]

Hi there,

in OPNsense 26.7.1_1, OpenVPN Client Export fails with "Certificate does not belong to server CA"

Same export within Version 26.1 worked without problems, the Server-Configuration was not changed between 26.1 and 26.7

A newly created, second server-config (using instances and newly created ca) throws same error message when trying to export.

any ideas?

Thank you.

[Monviech (Cedrik)]

I just tested the export and it works for me.

Maybe you are doing something wrong with your certificates?

Try using openssl on the command line to check if your CA and your Leaf certificates are correctly issued.

[SchengFui]

unfortunately i am not familiar with openssl in console :-(

and honestly, i dont understand the error-message... the option "Certificate Authority" is set to "-Use from certificate", so how is it possible the the ca does not belong to the certificate? Setting the option "Certificate Authority" to the correct ca for the certificate leads to this error message too. CA and server certificate have been multiple times deleted and newly created (without any errors).

I'm in doubt, that this problem is related to the ca and certificate, but i have no idea where to look now.
   
   

[SchengFui]

Could someone please help me with the certificate-storage-paths ?

i found the root certs in /usr/local/share/certs, but i have no idea where to look for the leaf certificates.