Bug #4934
closed
OpenVPN Client Export Doesn't Include Full CA Chain
0%
Description
When exporting an OpenVPN configuration, only the CA immediately above the server's certificate is included. If that is an intermediate CA, then the client is then unable to verify the server's certificate and the connection fails.
I suggest that it should instead export a .crt file with the entire certificate chain back to the root CA, returning an error if it doesn't have the entire CA chain in it's database.
(In my situation, I have a company CA, used to sign an intermediate CA for pfSense, which is used to sign the OpenVPN server certificate.)
Related: #4756
Updated by Kyle Johnston over 9 years ago
Issued Pull Request: https://github.com/pfsense/pfsense-packages/pull/1016
Updated by Chris Buechler about 9 years ago
- Affected Version changed from 2.2.x to All
Updated by Phillip Davis about 9 years ago
The pull request that was finally merged was https://github.com/pfsense/pfsense-packages/pull/1029
Is that all there is to do hear? Should this be marked resolved?
Updated by Kyle Johnston about 9 years ago
Is that all there is to do hear? Should this be marked resolved?
Yes.