I have two secret files and OpenVPN on the iPad - now what?

jmortimer

On a computer the OpenVPN application can use these two secret files that were produced by our firewall when a new connector was set up (they are plain text - .ovpn and .txt, the .txt contains a static key), I managed to import the .ovpn file to OpenVPN on the iPad fine, but it is asking for a certificate file before I can connect.

How can I get the .txt file into OpenVPN? It is currently languishing in Mail as an attachment, Mail just displays it as a text file and I don't seem to be able to do anything else with it.

temporaer

Hey jmortimer,

just add the content of the key-file into your .ovpn profile.
Use the following format, as the app internal help suggests:

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>

The same works for key and cert files.

Cheers

jmortimer

Hmm. I just tried that but it didn't work, still asked for a certificate. I checked the online help, it looks like secret files are not currently supported. Well, looks like no iOS OpenVPN for me then until that feature is added. 🙁

mwandelaar

This feature is well supported. And user Temporaer made a good suggestion, but as you are using a static key, it's not the CA which needs to be inline, but a secret:

<secret>
-----BEGIN OpenVPN Static key V1-----
.......
-----END OpenVPN Static key V1-----
</secret>

And remove (or comment) any line in the configfile which starts with

secret <some-file-name>

Hope this helps.

jmortimer

I have done that but it is the same - it asks for a certificate from the keychain.

mwandelaar

Can you post the server and client configfiles, and if possible the logging on the client? (That will be some kind of screenshot i guess)

jmortimer

I just have my two secret files, here is the ovpn file that I have added the key file to. I have removed some bits for security.

# "Jonathan Mortimer" client configuration

comp-lzo
dev tun
float
ifconfig 172.x.0.9 172.x.0.10
no-replay
port x
proto udp
remote x.x.x.x
resolv-retry infinite

verb 3

route 192.168.x.0 255.255.255.0
route 192.168.x.0 255.255.255.0
route 192.168.x.0 255.255.255.0

route 172.x.0.0 255.255.255.0
route 172.x.0.0 255.255.255.0
route 172.x.0.0 255.255.255.0

<secret>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
57276eeb35723b7e9b803c6106f08625
blah blah blah
81f48af63d5f347a22621dd4451cff27
-----END OpenVPN Static key V1-----
</secret>

mwandelaar

As far a i know the keychain is something from the operating-system. The configfile looks OK to me and does not need any additional certificates.
Can you test if this configfile is working on your pc?

jmortimer

Confirmed working with Tunnelblick on the Mac (which my two secret files for the same connection work with too).

mwandelaar

This confirms the configfile is correct.
Unfortunatly i don't have a clue where the iPad is asking for: It's not the certificate for the connection for sure as you confirmed allready.
Maybe someone using an iOS device can help?

mcorriel

I am having essentially the same problem with this app on the iPad. I am using a static secret key on the client and server. I create the .ovpn client profile using <secret> and </secret> to bracket the key data.

The problem is the OpenVPN Ipad client continues to require the selection of an external certificate authority. No logs are generated because the client never attempts a connection.

the text of the .ovpn profile which causes the iPad client to ask for a ca is shown here.

remote 192.168.1.50
dev tun
ifconfig 10.10.10.2 10.10.10.1
route 192.168.1.0 255.255.255.0

auth none

cipher none

key-direction bidirectional

<secret>
-----BEGIN OpenVPN Static key V1-----
72aa55e23a63f8ff72249cde056fc310
2a6b0d945603b5f11056dd7ff1b6cea5
e5a69fda0afc89b55994593b6e1cb70a
da723b1e336b98d76b2817736efed016
93506a72149145e060514a0c7b35e974
ca21cc86a37d862174fd45129413597e
4da567a15b7e18db83a730307bc9ef46
03296d0775f119ea1a1e51c38a66e08b
2b3e804b9a66f18b89aff112851257aa
5209081008041791a8f0b851aceb49b4
b378beb958b32422a4de15148f30bb9a
7a3ef5f9a01929b14a6bfff1a7a7fa17
488db512b98cb151c4b61f0bab9269c9
ea1db335a2435e0106c0ffb7943ae73a
497d5b4b82864632dcb763749b78c680
76fd09c4c1cd5b6f338eada26120d61b
-----END OpenVPN Static key V1-----
</secret>