pfSense » pfSense Packages

Jim,
you are right, the CA/certificate|key and server/certificate|key are both imported.
But the server/certificate is from that CA.

How long ago did you import that certificate into a 2.0 install? I checked a CA/Cert I recently had imported into a VM and it had a proper caref.

Indeed the code does check to add a proper CA reference when importing a certificate:

    if($issuer <> $subject) {
        $issuer_crt =& lookup_ca_by_subject($issuer);
        if($issuer_crt)
            $cert['caref'] = $issuer_crt['refid'];
    }

So something about that CA/certificate must have made it not match up when you imported it (or perhaps you imported the cert before the CA, instead of the other way around).

I've just migrated, 2 days ago. So I imported it 1 day ago.
The issue seems to be with my ca_subject not matching to cert_issuer.

function & lookup_ca_by_subject($subject) {
        global $config;
        if (is_array($config['ca']))
                foreach ($config['ca'] as & $ca)
                {
                        $ca_subject = cert_get_subject($ca['crt']);
                        if ($ca_subject == $subject)
                                return $ca;
                }
        return false;
}

My current $ca_subject and $subject are:

ca_subject -> emailAddress=xxx, ST=xxx, OU=xx, O=xxx, L=xxx, CN=xxx, C=xxx
   subject -> emailAddress=xxx, CN=xxx, OU=xx, O=xxx, L=xxx, ST=xxx, C=xxx

So, yes they are a match, but they are not equal, in the strict syntax way.
($ca_subject and $subject here are a concatenation of strings ... )

I've looked into the code for certs.inc, and check how those strings are generated, and
everytime that subject is retrieved,see function cert_get_subject(...), the components
that made the array are sorted. Which is not the case for "issuer", see function cert_get_issuer(...)
-- Simple solution, that I've tested and it works, is to :

  function cert_get_issuer($str_crt, $decode = true) {

        if ($decode)
                $str_crt = base64_decode($str_crt);

        $inf_crt = openssl_x509_parse($str_crt);
        $components = $inf_crt['issuer'];

        if (!is_array($components))
                return "unknown";
//fix -->
        ksort($components);
//fix <--
        foreach ($components as $a => $v) {
                if (!strlen($issuer))
                        $issuer = "{$a}={$v}";
                else
                        $issuer = "{$a}={$v}, {$issuer}";
        }

        return $issuer;
}

In the current code there is already a ksort there. I assume you upgraded to the official RC1 and not to a snapshot?

It was added in https://github.com/bsdperimeter/pfsense/commit/bfa992bc4eb8f8674f44b94e8617a032854356e9#etc/inc/certs.inc

Yes I updated to the official RC1.

So I guess it will be pushed on to the next RCx.

Mistery Solved :)

Thanks.

Still having what appears to be the same issue.
Generate a CSR from pfSense, get a signed cert (from StartSSL) for pfSense, import cert into pfSense.
Works great.
Assign that cert to OpenVPN server, try to use openvpn client export, get failure.

"The following input errors were detected:
Could not locate the CA reference for the server certificate.
Failed to export config files!"

Running on 2.2-RELEASE x86 (32-bit).
Public cert available for inspection at https://remote.avant.ca:8443/ and of course OpenVPN at that hostname, too.
Works perfectly with self-signed cert, but I don't want to force users to obtain and install self-signed cert, at least not until pfsense or openvpn provides a way to download it on demand.