Hi,
I have the following setup:
Dogtag CA serving all certificates
port 443
proto tcp
dev tun
ca /etc/pki/ca-trust/source/anchors/root_ca.crt
cert /etc/pki/tls/certs/server.crt
key /etc/pki/tls/private/server.key
dh /etc/pki/tls/dh2048.pem
topology subnet
server 10.215.201.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.20.130.0 255.255.255.0"
push "route 10.20.131.0 255.255.255.0"
push "dhcp-option DNS 10.20.130.16"
push "dhcp-option DOMAIN test.domain"
duplicate-cn
script-security 3 system
x509-username-field ext:email
tls-verify /etc/openvpn/verify-env.rb
crl-verify /etc/openvpn/crl.pem
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
I have configured my user certificates with an X509v3 Subject Alternate name email address, but I am unable to connect, I am seeing the following errors
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) TLS: Initial packet from [AF_INET](hiddenIP), sid=8a6e7c9b d153a5eb
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) VERIFY SCRIPT OK: depth=2, C=UK, ST=London, L=London, O=(hidden), CN=(hiddenDOMAIN)
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) CRL: CRL /etc/openvpn/crl.pem is from a different issuer than the issuer of certificate C=UK, ST=London, L=London, O=(hidden), CN=(hiddenDOMAIN)
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) VERIFY OK: depth=2, C=UK, ST=London, L=London, O=(hidden), CN=(hiddenDOMAIN)
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) VERIFY SCRIPT OK: depth=1, CN=CA Signing
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) CRL: CRL /etc/openvpn/crl.pem is from a different issuer than the issuer of certificate CN=CA Signing
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) VERIFY OK: depth=1, CN=CA Signing
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) VERIFY ERROR: could not extract ext:email from X509 subject string ('CN=same') -- note that the username length is limited to 64 characters
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) TLS Error: TLS object -> incoming plaintext read error
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) TLS Error: TLS handshake failed
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) Fatal TLS error (check_tls_errors_co), restarting
Apr 16 16:34:25 asbcl-ovpn openvpn[16991]: (hiddenIP) SIGUSR1[soft,tls-error] received, client-instance restarting
If i do the same thing but have the email address are part of the Subject all works normally, I really need to be able to pass what is configured under the subjectAltName as we are soon going to be moving to a new CA solution that doesn't support the legacy method of email address in the Subject field.
I have also tried with
x509-username-field ext:subjectAltName
as per the documentation
Am I missing something?
Any help would be much appreciated
Sam
