OpenVPN CLient Export fails with "Certificate does not belong to server CA"

[SchengFui]

Hi there,

in OPNsense 26.7.1_1, OpenVPN Client Export fails with "Certificate does not belong to server CA"

Same export within Version 26.1 worked without problems, the Server-Configuration was not changed between 26.1 and 26.7

A newly created, second server-config (using instances and newly created ca) throws same error message when trying to export.

any ideas?

Thank you.

[Monviech (Cedrik)]

I just tested the export and it works for me.

Maybe you are doing something wrong with your certificates?

Try using openssl on the command line to check if your CA and your Leaf certificates are correctly issued.

[SchengFui]

unfortunately i am not familiar with openssl in console :-(

and honestly, i dont understand the error-message... the option "Certificate Authority" is set to "-Use from certificate", so how is it possible the the ca does not belong to the certificate? Setting the option "Certificate Authority" to the correct ca for the certificate leads to this error message too. CA and server certificate have been multiple times deleted and newly created (without any errors).

I'm in doubt, that this problem is related to the ca and certificate, but i have no idea where to look now.
   
   

[SchengFui]

Could someone please help me with the certificate-storage-paths ?

i found the root certs in /usr/local/share/certs, but i have no idea where to look for the leaf certificates.

[SchengFui]

Hi there,

Problem was solved by downgrading to 26.1.11_10, export now works as expected again.

[dseven]

There was a recent change:

https://github.com/opnsense/core/commit/f7c5fa866f6e50faec1a4ecaaf813100166ba567

If I'm reading this right (may not be - haven't really dug in), it looks like there's a new requirement that the user cert be issued from the same CA as the server cert...?

[SchengFui]

for testing purposes i created an new ca, created a server and a client cert from this ca and the error occured when trying to export...

maybe i'll investigate further when i find some time, but to be honest i'm not familiar with openssl...

[Monviech (Cedrik)]

I just created a new CA + a server and client certificate and I could export the client.

Maybe something you are doing is wrong, post exact instructions (step by step) how to reproduce your issue.

I think you might be accidentally missing the issuer in the server or client certificate and its accidentally on "self-signed" instead of the previously created CA.

[SchengFui]

i'm pretty sure i do it right, because of the fact that choosing the right ca (and not leave it selfsigned) autofills most of the lines under general. i noticed that every time i created a new cert.

i'll ivestigate further. i have both (the working and non-working) installations as VMs.