MS CA cert in OpenVPN unhandled critical extension

smok

Hi All.
I'm trying to set up OpenVPN to use Microsoft CA. I've set up fully functional PKI and got my certificate on the smartcard. Trying to connect to the OpenVPN server throws an error with informations in the openvpn.log as below:

WRRWWWRRWWWWRWRFri Nov 24 17:25:56 2017 us=489982 71.234.216.68:13343 VERIFY ERROR: depth=0, error=unhandled critical extension: DC=local, DC=DOMAIN, CN=Users, CN=MyUserName
Fri Nov 24 17:25:56 2017 us=490236 71.234.216.68:13343 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Fri Nov 24 17:25:56 2017 us=490270 71.234.216.68:13343 TLS_ERROR: BIO read tls_read_plaintext error
Fri Nov 24 17:25:56 2017 us=490288 71.234.216.68:13343 TLS Error: TLS object -> incoming plaintext read error
Fri Nov 24 17:25:56 2017 us=490305 71.234.216.68:13343 TLS Error: TLS handshake failed

I understand that this is related to the certificate configuration. The part mentioned in log "DC=local, DC=DOMAIN, CN=Users, CN=MyUserName" is a Fully Distinguished Name field value from the cert. This information is build from the active directory information set.
Curious is fact that I've setup working solution based on openVPN and MS AD CA and it worked flawlessly. I cant see any significant differencies between that old deployment and new one. My server config is as follows:

port 1194
proto udp
dev tun
ca cert/rootCACert.crt
cert cert/certificate.crt
key cert/privateKeyDecrypted.key
dh cert/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.3"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5

Could someone help me with this?
Thank You
Smok.

TinCanTech

Why are you using a Microsoft CA .. Do you have access to the CA.key ?

smok

I'm using MS CA becouse i'ts quite good certificate manager. Yes, this PKI is in my hands, i have access to all keys in it.

TinCanTech

We support EasyRSA.

smok

Do You mean, that i need to use Easy-RSA? That no other RFC compilant CA will work in OpenVPN? It does'nt sound good :shock:. Just like you have to have a tie to eat in the restaurant. MS CA is a very popular one. I would like to use it and i'm preety sure that the issue is only in configuration not in compliance.
Smok.

TinCanTech

You can use what ever you like .. but we only support EasyRSA.

If you can get "Microsoft CA" to work then document it and share it for others to try.
(A quick google tells me there is not much info available for it .. so good luck)

By the way .. you are the first person to ever mention it here so it is not popular with Open Source Software.

TiTex

You can definitely use MS CA to issue server/user certs for openvpn , i think it passed like 2 years since i set it up at he company where i worked and had no issues , we also used user/passwd auth with LDAP (AD) + client certs ... all from MS AD

What i would suggest is to check your certs if those are in order and correct format ... by default when you export a cert in MS CA mmc , it is exported as binary (DER) format , also check if the usage and constraints are correct and maybe if the cert matches the privatekey

these are linux commands in a bash shell but it's the same in cygwin ... or most likely there's a windows equivalent like certutil and powershell cmdlets

openssl x509 -in cert/certificate.crt -noout -purpose

or to check all o it's properties

openssl x509 -in cert/certificate.crt -noout -text

to check if privatekey belongs to cert

(openssl x509 -in cert/certificate.crt -noout -modulus | md5sum  ; openssl rsa -noout -modulus -in cert/privateKeyDecrypted.key | md5sum) | uniq

- this should return one line if both files have the same modulus , ie. the files are a pair