Unable to use OpenVPN with self-signed CA and Intermediate Chain

teward

I'm trying to use OpenVPN with a self-signed CA certificate which has its own intermediate CA chain.

The chain is essentially this - from the root CA outbound:

internal-ca
|- vpn-auth-ca
   |- OpenVPN Server Certificate (endpoint server cert, not a CA)

(vpn-auth-ca is also the issuer of the client certificates as well)

On the client side, I have the entire CA chain properly available for the system to figure out the issuer cert (because it didn't include internal-ca on client export).

However, on the server side, we get some hard failures, with this:

VERIFY ERROR: depth=1, error=unable to get issuer certificate: ... CN=vpn-auth-ca, ...

Now, normally I would attribute this to oddness in the cert stores, however all the intermediate certs AND the root cert are in pfSense's configuration and certificate store, so the only thing I can think of is that OpenVPN is not able to construct the chain, and I'll have to do this manually, but I have no way to do that in the GUI.

Is this a known issue, or is there a way I can work around the issue by manually defining the CA certificate chain file to use on the server side, since it's obviously incapable of constructing the chain itself.

teward

OK, so deep diving, this does not function as expected in pfSense if you try and chain CA certificates. It just doesn't and hard-fails.

The only way to do this is to use a single-tier OpenVPN Certificate Authority and then things just work. Unfortunate, but this is a solution we can work with (everything's stored in a X.509 cert management utility so nothing is lost and everything is equally secure).

Just annoying I can't use the intermediate chains...