pfSense

I am hit with the same bug.

Also, if you set the Peer Certificate Authority to the Root CA, 2 things happen:

1.
Certificate Depth in the Server tab needs to be adjusted.

2.
OpenVPN Client Export Utility stops working (Client Install Packages list becomes blank).

A potential workaround is to do the same for pfSense's OpenVPN server CA config as the solution to the first issue-
Append all the CA certificates in the chain to /var/etc/openvpn/server{x}.ca (root FS rw?)

Can anyone tell me the problem with this approach? (other than I shouldn't mess around with the FS directly).

After I posted the above, I have a new idea.

I just copied the Root CA certificate to the Intermediate CA's certificate in System: Certificate Authority Manager.

You mean you essentially created a cert chain yourself in the Certificate Authority Manager and then it worked?

Ran into the same issue today with version 2.1.4.
The hack to copy the full chain into the certmanager solves the problem but imho the correct behaviour should be to resolve the required certificates using the cert-manager and use the "extra-certs" option to provide the chain certificates.

Same broken behaviour in 2.2.

Adding the Root CA certificate to the Intermediate CA's certificate in System: Certificate Authority Manager still works as workaround.

Hey guys,
Still having this issue on 2.2.6
Workaround is working

Jim Pingle wrote:

This works fine in the base system and in the export package. I can make a CA, then make an intermediate CA, then make a server based on the intermediate, and a user based on the intermediate. Select the server cert and the server config has the full chain. Export the user cert and it has the full chain. Set the depth to 2 and the user connects fine. Looks good to me, closing the ticket.

I can confirm this fixed the above issue with OpenVPN, but seems to introduce another problem if I use the Intermediate CA for LDAP+SSL. It breaks LDAP+SSL authentication, if the intermediate CA does not contain the full CA chain as per the workaround above.

Hello guys, I have a very similar setup using v2.3.2 in AWS, I'm still hitting this issue, but in my case seems to be caused by line endings; I made an edit of my root CA's name, and this messed up the line endings of the exported cert (to CRLF). Meanwhile, the intermediate CA and client cert are stored in pfSense as LF. The effect is that when I export my OpenVPN configuration using the wizard, I end up with a file that mixes line endings for the different certs of the chain.