OpenVPN service not working with PfSesne 2.4?!

mucip

Hi,
I want to use OpenVPN with PfSense 2.4.1. I followed below link.
https://youtu.be/VdAHVSTl1ys
https://www.serdarbayram.net/pfsense-remote-vpn.html

But I can not run OpenWPN service. Error log below;
Nov 12 02:10:50 openvpn 67991 OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Oct 8 2017
Nov 12 02:10:50 openvpn 67991 library versions: OpenSSL 1.0.2k-freebsd 26 Jan 2017, LZO 2.10
Nov 12 02:10:50 openvpn 71074 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
Nov 12 02:10:50 openvpn 71074 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Nov 12 02:10:50 openvpn 71074 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Nov 12 02:10:50 openvpn 71074 Cannot load certificate file /var/etc/openvpn/server1.cert
Nov 12 02:10:50 openvpn 71074 Exiting due to fatal error

And I checke the /var/etc/openvpn/server1.cert. It's empty file!... :(

Regards,
Mucip:)

jimp

Is this a new setup in 2.4.1 or was it working in a prior version?

Is the certificate correct in the certificate manager? Maybe try creating a new certificate or importing it again?

mucip

Dear Jimp,
Sorry for this mass. I reset and reconfigured everything and it started to work. Thanks for your kind interest.

Regards,
Mucip:)

bpb21

I have this exact issue, with this exact error message about Cannot load certificate file /var/etc/openvpn/server1.cert in pfSense 2.4.2 and the really bizarre thing: it was working fine previously. I don't mean on a previous pfSense build; I mean until I tried it remotely today.

Ever since it stopped working, I've tried to completely clear out all certificates and recreate the OVPN server. But I end up with the same error.

Any ideas what this might be about? I run about five pfSense servers in different locations (not connected to each other) and I've noticed while two are working, three are not. (I blame two of the non-working ones on external factors.)

Very confused…

bpb21

Oh - system logs. I kept getting the same errors over and over. I'd completely remove an OpenVPN server, all certificates, and try again from scratch. And I'd keep getting the same message over and over in the system logs. (The definition of insanity?)

Dec 3 18:48:09 openvpn 34472 Exiting due to fatal error
Dec 3 18:48:09 openvpn 34472 Cannot load certificate file /var/etc/openvpn/server1.cert
Dec 3 18:48:09 openvpn 34472 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Dec 3 18:48:09 openvpn 34472 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 3 18:48:09 openvpn 34472 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
Dec 3 18:48:09 openvpn 34296 library versions: OpenSSL 1.0.2m-freebsd 2 Nov 2017, LZO 2.10
Dec 3 18:48:09 openvpn 34296 OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Oct 8 2017
Dec 3 18:21:31 openvpn 48163 Exiting due to fatal error
Dec 3 18:21:31 openvpn 48163 Cannot load certificate file /var/etc/openvpn/server1.cert
Dec 3 18:21:31 openvpn 48163 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Dec 3 18:21:31 openvpn 48163 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 3 18:21:31 openvpn 48163 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
Dec 3 18:21:31 openvpn 48127 library versions: OpenSSL 1.0.2m-freebsd 2 Nov 2017, LZO 2.10
Dec 3 18:21:31 openvpn 48127 OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Oct 8 2017
Dec 3 18:20:14 openvpn 65340 Exiting due to fatal error
Dec 3 18:20:14 openvpn 65340 Cannot load certificate file /var/etc/openvpn/server1.cert
Dec 3 18:20:14 openvpn 65340 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Dec 3 18:20:14 openvpn 65340 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 3 18:20:14 openvpn 65340 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
Dec 3 18:20:14 openvpn 65096 library versions: OpenSSL 1.0.2m-freebsd 2 Nov 2017, LZO 2.10
Dec 3 18:20:14 openvpn 65096 OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Oct 8 2017
Dec 3 18:19:38 openvpn 29240 Exiting due to fatal error
Dec 3 18:19:38 openvpn 29240 Cannot load certificate file /var/etc/openvpn/server1.cert
Dec 3 18:19:38 openvpn 29240 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Dec 3 18:19:38 openvpn 29240 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Dec 3 18:19:38 openvpn 29240 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts

jimp

What is in /var/etc/openvpn/server1.cert ?

septer012

I have similiar output when I try the wizard, and look at the openvpn log. I have an empty 0 byte /var/etc/openvpn/server1.cert

Version 2.4.4-RELEASE-p3 (arm64)

Jun 13 20:07:32 	openvpn 	49559 	Exiting due to fatal error
Jun 13 20:07:32 	openvpn 	49559 	Cannot load certificate file /var/etc/openvpn/server1.cert
Jun 13 20:07:32 	openvpn 	49559 	OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Jun 13 20:07:32 	openvpn 	49559 	OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Jun 13 20:07:32 	openvpn 	49559 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 13 20:07:32 	openvpn 	49485 	library versions: OpenSSL 1.0.2o-freebsd 27 Mar 2018, LZO 2.10
Jun 13 20:07:32 	openvpn 	49485 	OpenVPN 2.4.6 aarch64-portbld-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Oct 3 2018

netblues

@septer012 Any .cert file should be about 1.7kbytes, a text file starting with -----BEGIN CERTIFICATE-----
So this is certainly the problem.
Try recreating server certificates and see if it produces correct files.
Are you doing the whole process via the web gui? is it a self signed certificate?

septer012

@netblues I am running the openvpn wizard. I am not sure how to generate the certificates manually on the box, but I will take a look around.

netblues

@septer012 I didn't mean to do it manually.
Do it via the webif, just check file sizes after every step
Looks like a bug, but need to find out if the file is ever created or it gets overwritten.

septer012

@netblues Still haven't quite figured it out yet. The whole process I am running the webgui OpenVPN wizard. I will peruse the logs I guess to see when the keys get generated.

 	/var/etc/openvpn
 server1.ca
	1.39 KiB
 server1.cert
	0.00 KiB
 server1.conf
	1.06 KiB
 server1.interface
	0.01 KiB
 server1.key
	1.64 KiB
 server1.sock

 server1.tls-auth
	0.62 KiB

septer012

I think I got it to work. I deleted all the Certificate Authorities, and Certificates. Next I configured Services - ACME certificates - Account Key. OpenVPN was able to start up.

Gertjan

@septer012 said in OpenVPN service not working with PfSesne 2.4?!:

ACME certificates - Account Key

What his this to do with OpenVPN ?

Rico

You want to use self signed Certs with OpenVPN, not from any other CA!

-Rico