Issue with two CAs
-
I have two CA's for client certificates from two locations.
Both locations utilize 'pivpn', which generates the CA certificate automatically during the install.
Up until 2.5 life was good, however now I'm having issues where the pfsense open vpn client complains of self-signed certificate. Dug through the forums and it seems this error is actually thrown when the wrong CA is used to validate the server key.
Long story short, when creating the CAs in pfsense they appear as if one issued the other and vice versa. Whichever CA I import last appears to have issued the one I imported previously. The latest one shows as 'self-signed', as expected.
With all of the above in mind, pfsense is somehow confusing who issued the CA certificates.
Has anyone run into this before? If so, how can I fix it?
-
Modified the pivpn install script and set the CN for one location to be different.
It seems pfsense computes identical hashes otherwise and gets confused which is which.