We have an OpenVPN server (as part of a MikroTik router RouterOS 5.21 deployment). Its OpenVPN server presents a Certificate chain with the following DNs (from output of 'openssl x509 -in <file> -noout -text' commands):
Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3
Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
.. and its own certificate (as it appears in the MikroTik RouterOS console):
C=ES,ST=56,L=BARCELONA,O=SOCIAL POINT, S.L.,CN=*.socialpoint.es
The DNs as they appear in an OpenVPN log file of a successful connection to this server:
Fri Jan 04 16:41:22 2013 VERIFY OK: depth=2, /C=US/O=DigiCert_Inc/OU=www.digicert.com/CN=DigiCert_High_Assurance_EV_Root_CA
Fri Jan 04 16:41:22 2013 VERIFY OK: depth=1, /C=US/O=DigiCert_Inc/OU=www.digicert.com/CN=DigiCert_High_Assurance_CA-3
Fri Jan 04 16:41:22 2013 VERIFY X509NAME OK: /C=ES/ST=56/L=BARCELONA/O=SOCIAL_POINT__S.L./CN=_.socialpoint.es
Fri Jan 04 16:41:22 2013 VERIFY OK: depth=0, /C=ES/ST=56/L=BARCELONA/O=SOCIAL_POINT__S.L./CN=_.socialpoint.es
We're having a problem with some MacOSX clients, using TunnelBlick as the OpenVPN wrapper, I
think specifically when TunnelBlick (which it does by default) selects an OpenVPN 2.3alpha version client (apparently, TunnelBlick brings at least a couple of OpenVPN versions with it), where the OpenVPN client fails to verify the OpenVPN server's certificate, if the expected certificate's DN in the client configuration file is formatted as:
tls-remote "/C=ES/ST=56/L=BARCELONA/O=SOCIAL_POINT__S.L./CN=_.socialpoint.es
instead of as:
tls-remote "C=ES, ST=56, L=BARCELONA, O=SOCIAL POINT, S.L., CN=*.socialpoint.es"
If we write the expected server certificate DN with the slashes, we get this error in the MacOSX OpenVPN 2.3alpha log file:
Tue Jan 8 17:01:50 2013 VERIFY X509NAME ERROR: C=ES, ST=56, L=BARCELONA, O=SOCIAL POINT, S.L., CN=*.socialpoint.es, must be /C=ES/ST=56/L=BARCELONA/O=SOCIAL_POINT__S.L./CN=_.socialpoint.es
Tue Jan 8 17:01:50 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Tue Jan 8 17:01:50 2013 TLS Error: TLS object -> incoming plaintext read error
Tue Jan 8 17:01:50 2013 TLS Error: TLS handshake failed
Tue Jan 8 17:01:50 2013 Fatal TLS error (check_tls_errors_co), restarting
I searched, and found a Change Log entry from eight years ago, about adding the functionality for the OpenVPN client certificate DN verifier to understand both the /slash and the ,comma forms.
In the 2.3alpha versions, was this regressed?
What is the "right" format to write the expected server certificate DN in an OpenVPN client configuration file?
Thanks,
-Jay
