Client Export - Could not locate the CA reference for the server certificate.

hugoeyng

Hello.

The clients to export
2.4.5-RELEASE-p1 (amd64)
built on Tue Jun 02 17:51:17 EDT 2020
FreeBSD 11.3-STABLE

At VPN -> OpenVPN -> Client Export there was a list of clients that I could export the config file.

Today when I went there to export a client, the list of those clients were no more there.

At this window I can read "Only OpenVPN-compatible user certificates are shown".

I did not change certificates.

Then I removed the certificate from the user and recreated it as "User Certificate".

The user appeared in the list again, but when I try to export it the message "Could not locate the CA reference for the server certificate" appears and doesn´t export anything.

If I create de certificate as Server Certificate the user doesn´t appear in the list to export.

What should I look for?

jimp

Sounds like your certificates were not properly configured before.

Your server certificate and user certificates should be made with the same CA.

The server certificate should be created as a server certificate only.

The user certificates should be created as user certificates only.

If you chose the server certificate option when making user certificates in the past, that wasn't correct. Newer versions of OpenVPN have begun rejecting those certificates, so the export package now filters them out.

hugoeyng

Thank you for your answer @jimp

Do I need one client and one server certificate for each user?

jimp

No.

You only need one server certificate, for the server itself. If you have multiple servers, you can use one server certificate per server, though multiple servers could all use the same server certificate.

Each user only needs its user certificate, made with the same CA that made the server certificate.

hugoeyng

Hello @jimp

The CA:

The user certifcate:

The user setup:

The client export:

jimp

What about the server certificate?

The error is complaining about that, not the user certificate.

devnet

@hugoeyng Hello Friend,

I was facing the same issue when I set up PfSense OpenVPN. I tried the below steps and I got a positive result. Hope it will be helpful.

If you already tried to set up and facing the same issue, Then delete all current configurations related to OpenVPN
Now Start to set up from scratch using the setup wizard.

In the second step of the setup wizard, it will give you the prompt to generate a CA certificate.

Now Complete the remaining setup as per your requirement.

Hope that issue will be resolved by step 2.

devnet

@hugoeyng

Now OpenVPN setup is complete. Make some changes in the settings, for this click on the 
edit button and go to the "Tunnel Settings" Section And click on the checkbox as shown in the image.

Now Create a user to log in to OpenVPN System > User Manager > +Add.

Now go to the OpenVPN client Export and export the user file. Then install the setup file in the system login with username and password.

Have A Great Day!!