Core: OpenVPN: ca certificate shall include ancestors if not self-singed

[8191]

It seems that OpenVPN refuses to verify user certificates if it does not know all its ancestors. I.e. if the CA configured as "Peer Certificate Authority" in the OpenVPN Server UI is not self-signed, OpenVPN refuses to verify user certificates (even if signed directly by the _Peer Certificate Authority_) with the error VERIFY ERROR: depth=1, error=unable to get issuer certificate: Peer Certificate Authority.

A solution to this would be to add all ancestors of _Peer Certificate Authority_ to the ca file (/var/etc/openvpn/serverx.ca) if the CA is a sub-ca (i.e. not self-signed).

_See also: https://forum.opnsense.org/index.php?topic=4830.0_

[AdSchellevis]

timeout due to inactivity

[8191]

Actually still an issue. Did anyone ever try to use OpenVPN with TLS-Auth using a non-self-sigened root CA?

[wschlich]

Yes, it's still an issue with 19.1 (see https://forum.opnsense.org/index.php?topic=11601.0).

[wschlich]

@AdSchellevis can you please reopen the issue?

[AdSchellevis]

@wschlich are you planning to work on it?

[wschlich]

@AdSchellevis At least from a user perspective, yes :-)

[AdSchellevis]

Not a lot of people seem to be using this construction, hence the time out last time. I'll reopen this for now, but without people digging into the use case and related code, it's likely this will be closed again.

[wschlich]

From what I've seen, @8191 was absolutely right regarding his findings. I've written mine down at https://forum.opnsense.org/index.php?topic=11601.0 -- basically OPNsense does not add the full CA certificate chain to /var/etc/openvpn/serverX.ca when the Peer Certificate Authority is not a self-signed, but an intermediate CA (signed by a Root CA which is managed by OPNsense as well).
I guess there's already code in OPNsense to do a full resolution of a chain of CA certificates? If yes, the fix should be easy.

[wschlich]

The bug is in /usr/local/etc/inc/plugins.inc.d/openvpn.inc in lines 895+896 (on 19.1.1):
$ca = lookup_ca($settings['caref']);
openvpn_add_keyfile($ca['crt'], $conf, $mode_id, "ca");
Simply no full CA chain resolution code there.

https://github.com/opnsense/core/blob/d27cc8364252309c8e701bb805fbd8545f53ab50/src/etc/inc/plugins.inc.d/openvpn.inc#L895

[AdSchellevis]

but that would suggest it doesn't work for self-signed certificates either, let me take a quick peek.

[wschlich]

@AdSchellevis nope, works fine for self-signed Root CA certificates because the CA chain is completed already by adding just the Root CA certificate.

[AdSchellevis]

does OPNsense know the path for your intermediate CA?

[wschlich]

@AdSchellevis yes, it does, as it consists solely of CA certificates that are managed by the OPNsense CA manager :-)
There's currently simply no code in place to actually try a CA chain resolution. The chosen Peer Certificate Authority is simply copied 1:1 :(

[AdSchellevis]

ok, one moment.

[AdSchellevis]

@wschlich can you try https://github.com/opnsense/core/commit/67f49486708770633ca615ee41f53439e0a962ce ?

From your console, you should be able to install using:

opnsense-patch 67f4948

[wschlich]

@wschlich can you try 67f4948 ?

works flawlessly now (removed the workaround before having the openvpn instance config regenerated using the web UI), awesome! thank you :-) :+1:

[AdSchellevis]

Thank you!

[fichtner]

@AdSchellevis for 19.1.2?

[AdSchellevis]

@fichtner yes please :)

[wschlich]

@AdSchellevis , @fichtner you guys rock! :1st_place_medal:

[wschlich]

@AdSchellevis My OPNsense firewall reported an issue in /usr/local/opnsense/mvc/app/controllers/OPNsense/OpenVPN/Api/ExportController.php, line 205 (function accountsActivation). Is it maybe related to your patch? That function is working with 'caref' as well...

[AdSchellevis]

@wschlich it can't be related, new style mvc code has no relation with the legacy code base.

Can you open a new issue with the the full error?

[wschlich]

@wschlich it can't be related, new style mvc code has no relation with the legacy code base.

I see :-)

Can you open a new issue with the the full error?

Hmm, I submitted the issue via the web GUI crash reporting function. Did that already open up an issue somewhere?

[AdSchellevis]

sorry, we don't read those on a very regular bases, better to open a ticket describing steps to reproduce and data here.

[wschlich]

I see... :/ actually I have no idea how this error occurred. If it happens again, I'll open a github issue then.

[AdSchellevis]

ok, thanks