agelwarg wrote
But putting an inline unencrypted key on my device doesn't sound like a good solution. Is an encrypted .ovpn12 bundle on the (new) openvpn-specific keychain intended for more security?
Somehow - but it does not really increase security per se.
Security level will be similar to what we had in the previous version. However, the OpenVPN app is now restricted (i.e. it can't access the general iOS Keychain anymore, but only the portion it owns).
Using the .ovpn12 extension is required so that the file is opened by OpenVPN and not by iOS. This way OpenVPN can store the bundle in its own portion of the keychain.
agelwarg wrote
I was under the impression that prior to 1.2.5, my p12 cert bundle (deployed with a .mobileconfig file) was encrypted and transferred securely to the iOS keychain where it remained somehow encrypted. Any chance you can explain the way it was and the way it's expected to be with the new app-specific keychain?
First of all we have to make a distinction: opening a .p12 file manually (i.e. from Safari/Mail) is different than bundling it in a .mobileconfig.
When opening a .p12 file
manually it's iOS that takes care of opening the file and storing it. Thus it will endup in the iOS-specific keychain. OpenVPN can't access that part of the keychain anymore.
For this reason we have introduced the .ovpn12 file extension. When opening a file ending with .ovpn12 manually, it will be OpenVPN to take over and it will be able to store it in its own portion of the keychain. Overriding the .p12/.pfx extension was not possible as they are special and reserved to iOS.
Files dropped via iTunes can end either with .ovpn12, .p12 or .pfx because they are directly given to the app and iOS is bypassed.
When bundling a .p12 in a .mobileconfig it's again iOS to take over, HOWEVER, after we have introduced the fix that we are working on with Apple, iOS will understand that the bundle belongs to OpenVPN and will allow access to it. As of 1.2.5 this fix is not there yet, therefore bundled .p12 are still unaccessible.
In either case, when some key material is stored in the keychain it's encrypted by iOS and accessible only to the App responsible for it.
Storing the cert/key as a string in the profile or in the .mobileconfig will leave it as is.
Hope this clarifies
