Project

General

Profile

Bug #4934

OpenVPN Client Export Doesn't Include Full CA Chain

Added by Kyle Johnston over 4 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
OpenVPN Client Export
Target version:
-
Start date:
08/14/2015
Due date:
% Done:

0%

Estimated time:
Affected Version:
All
Affected Architecture:

Description

When exporting an OpenVPN configuration, only the CA immediately above the server's certificate is included. If that is an intermediate CA, then the client is then unable to verify the server's certificate and the connection fails.

I suggest that it should instead export a .crt file with the entire certificate chain back to the root CA, returning an error if it doesn't have the entire CA chain in it's database.

(In my situation, I have a company CA, used to sign an intermediate CA for pfSense, which is used to sign the OpenVPN server certificate.)

Related: #4756

History

#2 Updated by Chris Buechler about 4 years ago

  • Affected Version changed from 2.2.x to All

#3 Updated by Phillip Davis about 4 years ago

The pull request that was finally merged was https://github.com/pfsense/pfsense-packages/pull/1029
Is that all there is to do hear? Should this be marked resolved?

#4 Updated by Kyle Johnston about 4 years ago

Is that all there is to do hear? Should this be marked resolved?

Yes.

#5 Updated by Chris Buechler about 4 years ago

  • Status changed from New to Resolved

thanks

Also available in: Atom PDF