Hi We are running a openvpn Server on UDP using TLS authentication with client certs. Some clients have certificates from CA 1, others from CA 2. Therefore we have to implement multiple CRL files in order to check for revoked certificates from both CAs. We discovered that in our setup, the CRL files are not handled as expected. Even the CRL file is there AND a certificate has been revoked, the user can access - which is a critical flaw. Listing of /etc/openvpn/ca (obfuscated) shows the two crl files with the hashed names. [code] -rw-r--r-- 1 root root 1585 11. Aug 15:12 79f1a304.r0 -rw-r--r-- 1 root root 1012 10. Aug 13:12 0f1a85bc.r0 -rw-r--r-- 1 root root 1239 11. Aug 11:33 18321a6e.r0 [/code] If we now connect with the revoked client certificate, strace indicates that openvpn is looking for crl file names hash.r1 or hash.r2. If the file is not there, the client gets granted. [code] stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory) stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory) stat("/etc/openvpn/ca/79f1a304.r2", 0x7fff7a013b20) = -1 ENOENT (No such file or directory) stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory) stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory) [/code] Any ideas/comments are highly appreciated. Sven server.conf (obfuscated) [code] mode server tls-server topology subnet port 1194 proto udp dev tun capath /etc/openvpn/ca cert ca/openvpn.crt key ca/openvpn.key dh ca/dh2048.pem server 10.X.X.X 255.255.255.0 client-config-dir ccd ccd-exclusive keepalive 10 120 user nobody group nobody persist-key persist-tun status /data/openvpn/log/openvpn-status.log log-append /data/openvpn/log/openvpn.log verb 3 no-name-remapping [/code]

Michael, thanks for your reply. openvpn -verion shows: [code] OpenVPN 2.3.6 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 2 2014 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.03 [/code] If I interprete this right, this version should support multi CRL checks. This would proove what I have seen in strace. But, what is the golden rule for naming CRL files? Obviously it does not check the hash.[b]r0[/b] files. Instead it goes to hash.[b]r1[/b] or hash.[b]r2[/b]

[Solved]Multi CA CRL Problem

elsev7

Hi

We are running a openvpn Server on UDP using TLS authentication with client certs. Some clients have certificates from CA 1, others from CA 2. Therefore we have to implement multiple CRL files in order to check for revoked certificates from both CAs.

We discovered that in our setup, the CRL files are not handled as expected. Even the CRL file is there AND a certificate has been revoked, the user can access - which is a critical flaw.

Listing of /etc/openvpn/ca (obfuscated) shows the two crl files with the hashed names.

-rw-r--r-- 1 root root 1585 11. Aug 15:12 79f1a304.r0
-rw-r--r-- 1 root root 1012 10. Aug 13:12 0f1a85bc.r0
-rw-r--r-- 1 root root 1239 11. Aug 11:33 18321a6e.r0

If we now connect with the revoked client certificate, strace indicates that openvpn is looking for crl file names hash.r1 or hash.r2. If the file is not there, the client gets granted.

stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/79f1a304.r2", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)

Any ideas/comments are highly appreciated.

Sven

server.conf (obfuscated)

mode server
tls-server
topology subnet
port 1194
proto udp
dev tun
capath /etc/openvpn/ca
cert ca/openvpn.crt
key ca/openvpn.key
dh ca/dh2048.pem
server 10.X.X.X 255.255.255.0
client-config-dir ccd
ccd-exclusive
keepalive 10 120
user nobody
group nobody
persist-key
persist-tun
status /data/openvpn/log/openvpn-status.log
log-append  /data/openvpn/log/openvpn.log
verb 3
no-name-remapping

elsev7

anything else to provide here to fix this?

maikcat

please post openvpn logs verb 4

i need to know which openvpn/openssl version are you using

in sources i noticed this:

#if OPENSSL_VERSION_NUMBER >= 0x00907000L
      X509_STORE_set_flags (store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
#else
      msg(M_WARN, "WARNING: this version of OpenSSL cannot handle CRL files in capath");
#endif

Michael.

elsev7

Michael,

thanks for your reply.

openvpn -verion shows:

OpenVPN 2.3.6 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  2 2014
library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.03

If I interprete this right, this version should support multi CRL checks. This would proove what I have seen in strace. But, what is the golden rule for naming CRL files? Obviously it does not check the hash.r0 files. Instead it goes to hash.r1 or hash.r2

elsev7

The issue is gone. I guess due to the restart of the openvpn for increasing the log verbosity fixed the problem.

Tue Aug 25 09:46:52 2015 us=718804 XXXXX:43419 VERIFY ERROR: depth=0, error=certificate revoked: /C=CH/CN=Test Tester
Tue Aug 25 09:46:52 2015 us=718904 XXXXX:43419 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Tue Aug 25 09:46:52 2015 us=718919 XXXXX:43419 TLS Error: TLS object -> incoming plaintext read error
Tue Aug 25 09:46:52 2015 us=718927 XXXXX:43419 TLS Error: TLS handshake failed

Thanks to all of you, who replied.