pfSense » pfSense Packages

If you go to Diagnostics > Backup/Restore on the Config History tab and do a diff on the config entries before/after you clicked Save, what changed? What about a diff between when it was broken and fixed?

Without seeing the configuration you imported it's hard to say what might have happened but it's possible your original configuration used a variation of a specific string that didn't match up 100% with what it looks like on pfSense/FreeBSD, but it was close enough that OpenVPN knew what to do with it.

Jim Pingle wrote in #note-1:

Without seeing the configuration you imported it's hard to say what might have happened but it's possible your original configuration used a variation of a specific string that didn't match up 100% with what it looks like on pfSense/FreeBSD, but it was close enough that OpenVPN knew what to do with it.

The original config does not even mention auth, so this is entirely between the importer and the UI itself. I checked the config diff, as you suggested, and indeed there's an answer there:

-            <digest></digest>
+            <digest>SHA256</digest>

Since my config did not come with auth, the importer left the digest empty, which per current OpenVPN spec means it defaulted to SHA1. However, upon editing, the UI updated its value to SHA256. I guess there are two solutions:

1. to have the importer explicitly set digest to SHA1 if it wasn't provided by the config file
2. have the UI default to SHA1, but this wouldn't be safe in other use cases, like when setting up a new configuration from scratch, which should rather hint the SHA160 at least