OpenVPN client export 2.4.3 configuration lacks the certificate name in SUBJ

[bofh16]

Greetings,
I have the following setup related - OpenVPN server in Remote Access (SSL/TLS + User Auth) mode. LDAP authentication in place for the incoming VPN connections.

Observations:

• The (Win7) ovpn coniguration file, generated with the earlier versions of client-export package, includes the user certificate name for the "cryptoapicert" option, e.g. "SUBJ:user-cert".

• The (Win7) ovpn coniguration file, generated with the latest version of client-export package, does not include the user certificate name for the "cryptoapicert" option, e.g. "SUBJ:". This makes impossible to use the connection, without manually editing the configuration file first.

Additional notes:

• This behavior has been spotted for Win7 client package only. No other OS installations, generated by the latest client-export package have been used/tested so far.

• Unfortunately, I can't say for sure when the behavior changed, as there had been several client export package upgrades, before a new Win7 client was installed and the behavior observed.

Please, advise if this is and expected behavior.

TIA

[johnpoz]

You mean 1.4.12, which is what I show as the current package - it has dep on

Package Dependencies:
  openvpn-client-export-2.4.3_3   openvpn-2.4.3   zip-3.0_1   p7zip-16.02

[bofh16]

Yep, that's correct.

[johnpoz]

You sure this ever worked how you say?  There is bug filed in redmine that is over a year old.
https://redmine.pfsense.org/issues/6339
OpenVPN Client Export package option for "Use Microsoft Certificate Storage" does not specify which certificate to use

There I have validated that it only puts in this option
cryptoapicert "SUBJ:"

For it to work shouldn't it need the FULL DN and not just a username anyway?

I have never used openvpn cryptoapicert, wish could be of more help..

[bofh16]

While I agree, the bug description matches 100% the issue I have, I can confirm, after N-times checking of installation packages, generated with earlier versions of client-export, the SUBJ is set correctly and installation works without any intervention.

To be more specific about versions - OpenVPN GUI 11.4.0.0 works, the latest package includes 11.7.0.0, which doesn't.

[johnpoz]

I am not using the install package.  Using just the file config download.

[bofh16]

Thanks, but it seems it's "generate, then package" approach, e.g. same file.

Anyway, the main purpose of this post was to understand if it was a pfSense issue or not. Believe the answer is "yes". One possible explanation for the different behavior over time is "fix and re-introduce" has happened.

Appreciate the link from the bug database and the guidance provided.