Project

General

Profile

Actions

Regression #13056

closed

OpenVPN ``remote_cert_tls`` option does not behave correctly when enabled and later disabled

Added by Thorsten Zitterell almost 2 years ago. Updated almost 2 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
OpenVPN
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
22.05
Release Notes:
Default
Affected Version:
2.6.0
Affected Architecture:
amd64

Description

I have a OpenVPN server running on a pfsense with version 22.01 for some month now.
Multiple clients connect to the server.

Since the update to 22.01, I guess, client connections break with errors like:

Apr 13 11:01:57 192.168.253.1 openvpn56270: x.x.x.x:y VERIFY KU ERROR
Apr 13 11:01:57 192.168.253.1 openvpn56270: x.x.x.x:y TLS_ERROR: BIO read tls_read_plaintext error

Then, when I reload the OpenVPN server the problem persists.
However, when I open the configuration and save it again the problem disappears.

After some research I figured out that this problem probably occurs after rc.renewwanip[v6] was executed.

I compared the config.ovpn after the problem occured and after I saved the OpenVPN server configuration again and there was the option remote-cert-tls client in this file.

Currently, I am not using TLS auth, however there seems a script (openvpn.inc?) which adds the unwanted option remote-cert-tls client.

I am not sure if relevant but there are the following custom options:

mode server;
client-config-dir /var/etc/openvpn/server6/csc;
ccd-exclusive;
ifconfig 10.8.1.254 255.255.255.0;
push "route-gateway 10.8.1.254";
route 10.5.1.0 255.255.255.0 10.8.1.1;
route 10.5.2.0 255.255.255.0 10.8.1.2;


Related issues

Related to Feature #11865: Option to validate OpenVPN peer TLS certificate key usageResolvedViktor Gurov04/28/2021

Actions
Is duplicate of Bug #13077: remote-cert-tls client set in configuration regardless of Client Certificate Key Usage Validation option (after server restart only!)Duplicate

Actions
Actions

Also available in: Atom PDF