Hi! I was thrilled to finally see an OpenVPN client for iOS devices! I'm struggling with getting my client to work. I have laptop and desktop clients all working with my VPN server using the easy-RSA approach for authentication. I've created a similar client-config and key/cert for my iOS device but I get the following error when trying to connect to my OpenVPN server: 2013-01-23 13:29:22 EVENT: CORE_ERROR PolarSSL: error parsing config private key: X509 - Invalid RSA key tag or value : ASN1 - ASN1 tag was of an unexpected value [ERR] My private key for the iOS device is RSA in PEM mode. My cert is also in x509 mode. Do you guys know what the error code means and/or how to fix this? Thanks, Bobby

If you can generate a test certificate/key pair that causes this error in PolarSSL, we can certainly take a look at it. James

Hi! I guess it would be nice to know first if the iOS openvpn software will use keys/certs/CA using the easy-ca distro included in the UNIX/Linux openvpn software. I'm currently using that for my desktop/laptop/net-to-net VPNs. Does the iOS openvpn software work with easy-ca generated keys/certs? What format do the keys and certs need to be in when loaded onto an iOS device? Thanks, Bobby

The easy-rsa scripts generate standard X509 certs and RSA keys in PEM format which should be compatible with any OpenVPN version. James

Hi! I used the standard easy-rsa scripts and they are working with my existing openvpn setup. So, while they should work with iOS openvpn, its clear that there are cases where they don't. Did the openvpn folks test with easy-rsa? I'm not sure I want to post my certs and key as I would then need to invalidate and re-issue them for all my existing clients. Any other pointers to error messages and what they mean? Is polar_ssl an iOS package? Thanks, Bobby

I am also seeing the same issue.

I just tested this with a set of certs/keys generated by easy-rsa, and I'm not seeing any problems. I used the 2.0 version on Linux, and made one edit to the vars file to set KEY_SIZE=2048. I generated ca, dh, client, and server certs with standard commands: [code]. vars ./clean-all ./pkitool --initca ./pkitool --server myserver ./pkitool client1 ./build-dh[/code] I then wrapped these up into a test client/server configuration and connected using the iOS client. Everything worked as expected.

Hi! My easy-rsa was set up similarly. However, I'm using the default 1024 key size. Is this going to be a problem? Also, did you create a single .ovpn file and put the keys in it? I'm using a separate files for .ovpn, keys, and certs. Thanks, Bobby

I am also seeing the same issue. Config file plus certificates are working fine in Tunnelblick and with OpenVPN GUI under windows but not in OpenVPN Connect under IOS. 2013-01-30 22:54:06 ----- OpenVPN Start ----- 2013-01-30 22:54:06 EVENT: CORE_ERROR PolarSSL: error parsing config private key : X509 - Invalid RSA key tag or value : ASN1 - ASN1 tag was of an unexpected value [ERR] 2013-01-30 22:54:06 Raw stats on disconnect: 2013-01-30 22:54:06 Performance stats on disconnect: CPU usage (microseconds): 5887 Network bytes per CPU second: 0 Tunnel bytes per CPU second: 0 2013-01-30 22:54:06 ----- OpenVPN Stop ----- 2013-01-30 22:54:06 EVENT: DISCONNECT_PENDING :(

I'm also using separate opva and cert files. Works fine with Tunnelblick, not with the iOS client.

If somebody can send over a test priv key we can have a look at it! Paul Bakker Lead Maintainer for the PolarSSL SSL Library (https://polarssl.org)

PolarSSL: error parsing config private key

davewolfs

The method suggested by ungaghllalek works. The issue is that you cannot use a password.

Basically, password protected keys do not appear to work with this client. Everything else appears to be fine.

rdk@krupczak.org

Hi!

Thanks for the reply. The issue was not a password protected key.

The issue was that in more recent versions of openssl, keys are generated in some non-RSA format. I still dont know exactly what format it is in.

Once I converted from the non-RSA to RSA format private key, everything started working as planned.

Thanks,

Bobby

davewolfs

Is it possible to create a password protected RSA key?

davewolfs

Using the info above I was able to successfully create a password protected private key.

openssl rsa -in old.key -des3 -out new.key

peterloron

@ pjbakker @jamesyonan

Any update on this issue? Is it a problem with OpenSSL? OpenVPN? PolarSSL?

Thanks.

-pete

rdk@krupczak.org

Hi!

Its solved.

The forum topic contains the discussion and answers and my confirmation that it fixed the problem.

In short, newer versions of openssl generate private keys that are in some non-RSA format. The version of PolarSSL that ships with OpenVPN for iOS requires the private key to be in RSA format. Once one uses the openssl tool to convert the private key, openvpn iOS works just fine.

Thanks,

Bobby

ronnietaylor

Just wanted to post my findings on an almost identical error.

I've been battling with:

"PolarSSL: error parsing cert certificate"

It turns out this was a dependency issue on the Ubuntu system where I generate my keys. The solution ended up being to do 'apt-get install opensc'.

After that the recommended steps work like a charm.

I came to this solution after I realized that the client .crt file generated by ./pkitool was empty.

Then after reading the README, vars and openssl.cnf files again I couldn't shake that there was something silly missing. The repeated refs to pkcs are what jogged my brain. It wasn't until the 3rd perusal of README that I noticed it recommended installing opensc.

Not sure if my solution fits this exact case but maybe give it a go.

Best.

-- Ronnie

hontvari

The same issue also occurs on the latest Android client, 1.1.11 (build 44). The same workaround mentioned above does help here too, for passphrase protected keys:

openssl rsa -in old.key -des3 -out new.key

psakke

rdk@krupczak.org wroteWhat I see is:
older keys: -----BEGIN RSA PRIVATE KEY-----
new key: -----BEGIN PRIVATE KEY-----

I converted my key explicitly to rsa ...

I had the same error after app update on iPhone 5S. My .conf had "BEGIN RSA PRIVATE KEY", but it still didn't work. I then converted it again to RSA using `openssl rsa -in orig.key -out new.key` and it started working again.

One thing was that openssl threw an error reading the private key on my Mac OSX 10.7 (OpenSSL 0.9.8y 5 Feb 2013), but it worked on a random available OpenBSD (OpenSSL 1.0.0f 4 Jan 2012). I can't remember where I initially created the original keys, on my mac, linux or openbsd?

OpenSSL error on mac, on the key within the client config that used to work:

unable to load Private Key
94428:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:/SourceCache/OpenSSL098/OpenSSL098-49.1/src/crypto/asn1/tasn_dec.c:1315:
94428:error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error:/SourceCache/OpenSSL098/OpenSSL098-49.1/src/crypto/asn1/tasn_dec.c:827:
94428:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:/SourceCache/OpenSSL098/OpenSSL098-49.1/src/crypto/asn1/tasn_dec.c:747:Field=n, Type=RSA
94428:error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib:/SourceCache/OpenSSL098/OpenSSL098-49.1/src/crypto/asn1/d2i_pr.c:99:
94428:error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib:/SourceCache/OpenSSL098/OpenSSL098-49.1/src/crypto/pem/pem_pkey.c:125:

« Previous Page