Cannot load certificate after password change on AD

skodde

Hi All,

I've successfully tested a configuration in which the client certificate is installed in the Current User store on Windows and it is retrieved via the cryptoapicert option.

Everything works fine on Windows 7 and 10 with OpenVPN 2.4.0 and previous versions, however, as soon as the AD user changes their password (on the same local machine), OpenVPN cannot load the certificate anymore.

This is the error I get:

OpenSSL:error:C5066064:microsoft cryptoapi:CryptAcquireCertificatePrivateKey:Key not valid for use in specified state.
Cannot load certificate "THUMB:xx ... xx" from Microsoft Certificate Store

The certificate is correctly present in certmgr after the password change.
I've tried locking, logging out, rebooting, shutting down, nothing helps.
After reinstalling the certificate, everything works perfectly fine again.

The error is always reproducible in different scenarios, connected to the AD network directly or via OpenVPN.

I expect everything would work using the Local Machine store, but I need to use the Current User one.

Any ideas/suggestions?

I've also opened a ticket for this issue, but got no replies: https://community.openvpn.net/openvpn/ticket/822

Thanks.

P.S.
If an OpenVPN developer is willing to take a look and would like to suggest a donation to the project for the effort, the company I work for would be happy to oblige.

TinCanTech

skodde wroteI've also opened a ticket for this issue, but got no replies

Your question has been read ..

The problem is getting access to an environment to reproduce and solve the problem.
(and obviously, having the time to do so .. )

skodde wroteIf an OpenVPN developer is willing to take a look and would like to suggest a donation to the project for the effort, the company I work for would be happy to oblige.

I recommend you let the devs know this via the dev mailing list or irc channel.

skodde

It turns out that the problem is related to this Samba bug:
https://bugzilla.samba.org/show_bug.cgi?id=10980

It's fixed as of Samba version 4.2.0, with the following commits:
https://git.samba.org/?p=samba.git;a=commit;h=3d4407671140fb9ebb9291094d8c4f3dbd4cdc51
https://git.samba.org/?p=samba.git;a=commit;h=defd63541c8e1ee852b907f26be33bdc50aea214

Basically, the certificate generated by older Samba versions to be used with DPAPI is of insufficient size and breaks the whole re-encryption mechanism used by client machines after a password change.