After restoring configuration OpenVPN certificates missing

apara

I upgraded my hardware and installed the latest 2.5.2-RELEASE.

After restoring the configuration from the old 2.4.5-p1 installation/hardware and mapping interfaces everything is working except OpenVPN clients.

When I try to start OpenVPN client on my new setup I get this error:

Jul 21 14:53:39 openvpn 57939 Exiting due to fatal error
Jul 21 14:53:39 openvpn 57939 Cannot load certificate file /var/etc/openvpn/client3/cert
Jul 21 14:53:39 openvpn 57939 OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Jul 21 14:53:39 openvpn 57939 Initializing OpenSSL support for engine 'devcrypto'

I checked and the /var/etc/openvpn/client3/cert exists.

So, this is possibly related to the previous message:
OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak

Any suggestions on how to fix this?

Thanks.

apara

Answering my own question...

Adding this string to custom options allows things to work:
tls-cipher "DEFAULT:@SECLEVEL=0"

However, I am looking for a better way to do this.

bingo600

@apara

Have a look here
https://www.infopackets.com/news/10414/how-fix-openvpn-sslctxusecertificateca-md-too-weak

/Bingo

apara

@bingo600 thanks for the link. This looks like a better solution but I am not sure how to make this work on pfSense.

I am using VPN vendor, so I did not create the original certificates as they were given to me by the vendor.

Am I misunderstanding something?

bingo600

@apara

From the url above , it seems that your vendor needs to sign with SHA instead of MD5
Getting new updated certificates would be the correct solution.

But with some vendors ... "Good luck w that"

/Bingo