Hello all, There have been some references to a workaround to the current VoD/pkcs issue in 1.2.6. Some people have claimed that have found a workaround by using inline certs and keys. To clarify this for myself and others, has anyone gotten this to work with inline certs and keys IN A MOBILECONFIG FILE? I've gotten it to work on an imported openvpn config autologin profile, but when I transfer the exact same information to an apple mobileconfig, it doens't work (I've already implemented the \n). The VoD feature does not work with openvpn configs, and what I'm really after is getting the on Demand part to work. If anyone has gotten an mobileconfig with inline cert and key and VPN on Demand to work, would they be willing to share any tips and perhaps post a sample mobileconfig? Thanks.

What do you mean by doesn’t work? Fail to install the profile into iOS or that the VPN fails to come up according to your OnDemand rules?

Everything installs fine, the on demand initiates, but it just hangs on "connecting..." There's no detail in the openvpn connect log, so I can't figure out any more specifics.

Well, it looks like the mobileconfig and VoD potions are functioning. What do you mean by “autologin” profile? Sent from my iPad using Tapatalk

Same issue as me however I cant get my profile installed Using the same certs etc as before I upgraded to 1.2.6 Ive escaped all line breaks with \\n (double slash) as per FAQ's on Openvpn site and followed the other FAQ's Connection Name should be set to a name that will identity this profile on the device. Connection Type should be set to Custom SSL. Identifier should be set to "net.openvpn.connect.app". (on older versions this used to be net.openvpn.OpenVPN-Connect.vpnplugin). Server can be set to a hostname, or "DEFAULT" to use the hostname(s) from the OpenVPN configuration. User Authentication should be set to Certificate, and the client certificate+key should be attached as a PKCS#12 file. VPN On Demand should be enabled and match entries should be defined to instruct iOS under which conditions the VPN profile should be automatically connected. However it still says in logs that my certs are invalid and then the profile fails to install. Does anyone have a working template example of how their mobileconfig file looks like now that works, someone preferably that had an embedded p12 cert previously working thats now borken in 1.2.6

[quote=CHRISLINDSAY post_id=76157 time=1516282096 user_id=43054] Does anyone have a working template example of how their mobileconfig file looks like now that works, someone preferably that had an embedded p12 cert previously working thats now borken in 1.2.6 [/quote] There's an example posted here: https://github.com/iphoting/ovpnmcgen.rb/pull/12#issuecomment-357419649 Personally, my mobileconfigs pushed via MDM include both .p12 and inline cert + key components to workaround this issue currently.

So you have the p12 added through apple configurator in certificates and then inline also? Did you change the identifier, server and user authentication as per FAQ's? If possible could you send me your example if possible, im tearing my hair out here

[quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] So you have the p12 added through apple configurator in certificates and then inline also? [/quote] Yes. For easier transition when the bug/limitation gets fixed. [quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Migrating from OpenVPN Connect v1.1.1 to v1.2.x, the changes required are 1) the "identifier" to net.openvpn.connect.app, and 2) additionally including the contents of the .p12 payload inline as cert and key. [quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] If possible could you send me your example if possible, im tearing my hair out here [/quote] My configs are generated using my tool. But for your reference, here's a generated generic version: [code] PayloadContent PayloadDescription Configures VPN settings, including authentication. PayloadDisplayName VPN (vpn.example.com/VoD) PayloadIdentifier com.example.vpn.example-iphone.vpnconfig PayloadOrganization vpn.example.com PayloadType com.apple.vpn.managed PayloadUUID 2D973388-1012-4175-ACA0-C4064A16ABF3 PayloadVersion 1 UserDefinedName vpn.example.com/VoD VPN AuthenticationMethod Certificate OnDemandEnabled 1 OnDemandRules Action Disconnect InterfaceTypeMatch WiFi SSIDMatch home Action Connect InterfaceTypeMatch WiFi Action Ignore InterfaceTypeMatch Cellular Action Ignore PayloadCertificateUUID 75C3B20C-8067-4EE1-8DB2-598F92E26B2B RemoteAddress DEFAULT VPNSubType net.openvpn.connect.app VPNType VPN VendorConfig ca Contents of CA file\nWith newlines\nAnd more newlines\nThat should appear as one line cert Contents of cert file\nWith newlines\nAnd more newlines\nThat should appear as one line client NOARGS comp-lzo NOARGS dev tun key Contents of key file\nWith newlines\nAnd more newlines\nThat should appear as one line key-direction 1 remote vpn.example.com 1194 tcp remote-cert-tls server tls-auth Contents of TLS-Auth Key file\nWith newlines\nAnd more newlines\nThat should appear as one line Password password PayloadCertificateFileName example-iphone.p12 PayloadContent cDEyZmlsZSB0aGF0IHNob3VsZCBhcHBlYXIKSW4gYmFzZTY0IGVuY29kaW5n IGFzIDxkYXRhLz4= PayloadDescription Provides device authentication (certificate or identity). PayloadDisplayName example-iphone.p12 PayloadIdentifier com.example.vpn.example-iphone.credential PayloadOrganization vpn.example.com PayloadType com.apple.security.pkcs12 PayloadUUID 75C3B20C-8067-4EE1-8DB2-598F92E26B2B PayloadVersion 1 PayloadDescription OpenVPN Configuration Payload for example-iphone@vpn.example.com PayloadDisplayName vpn.example.com OpenVPN example@iphone PayloadIdentifier com.example.vpn.example-iphone PayloadOrganization vpn.example.com PayloadRemovalDisallowed PayloadType Configuration PayloadUUID A00F372B-49C3-45D4-8C08-AD62076A5BF4 PayloadVersion 1 [/code]

Many thanks its much appreciated. So you only use \n and then make sure its all in one line within a text editor? Did you change the identifier, server and user authentication as per FAQ's?

[quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] So you only use \n and then make sure its all in one line within a text editor? [/quote] Yes. The \\n is probably required only when using Apple Configurator? [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Please see my edited post above: https://forums.openvpn.net/viewtopic.php?f=36&t=25664&p=76164#p76162

[quote=iphoting post_id=76164 time=1516285632 user_id=22554] [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] So you only use \n and then make sure its all in one line within a text editor? [/quote] Yes. The \\n is probably required only when using Apple Configurator? [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Please see my edited post above: https://forums.openvpn.net/viewtopic.php?f=36&t=25664&p=76164#p76162 [/quote] Maybe the FAQ is not 100% clear - I'll ask to revise it a bit. Basically it says: [quote]The procedure is to convert the multi-line data to a single line by replacing line breaks with "\n" (without the quotes). Note that because of this escaping model, you must use "\\" to pass backslash itself.[/quote] Which means you have to use "\n" for line break and "\\" when you need a \. It's a way to escape special characters.

VPN On Demand - 1.2.6

CHRISLINDSAY

The profile installs but the connection just doesn't happen

Everything just stays at connecting ....

Any help on this would be much appreciated, under a lot of pressure to find a solution. Nothing working at present with all the changes I've made.

iphoting

This doesn’t look right from the logs:

Failed to find VPN plugin bundle container with ID net.openvpn.OpenVPN-Connect.vpnplugin

Are you sure the previous profile has been removed from the device?

iPhrankie

Is this thread related to this question I posted? Can I tweak the .mobileconfig to make it work?

https://forums.openvpn.net/viewtopic.php?f=36&t=25657
https://community.openvpn.net/openvpn/ticket/988

iphoting

iPhrankie wroteIs this thread related to this question I posted? Can I tweak the .mobileconfig to make it work?

https://forums.openvpn.net/viewtopic.php?f=36&t=25657
https://community.openvpn.net/openvpn/ticket/988

Looks like it. You might want to inline your cert and key, in addition to the .p12 payload and see if it works for you?

CHRISLINDSAY

iphoting wrote This doesn’t look right from the logs:

Failed to find VPN plugin bundle container with ID net.openvpn.OpenVPN-Connect.vpnplugin

Are you sure the previous profile has been removed from the device?

Definitely mate, that log entry confused me also as im using the new one now.

CHRISLINDSAY

Managed to get back up and running using a custom ovpn file, not ideal but should keep everyone up and running until this fix gets done by OpenVPN.

Thanks for all your help on this guys!

iPhrankie

What are the security implications of putting everything inline?

With the P12 method the key and cert were protected by a password. There is a password prompt at the time of importing the profile into the iPhone.

With this new method if the .mobileconfig escapes in transit then everything is compromised by having everything inline.

trifster

Hi all...so I stumbled onto this thread trying to make an .mobileconfig file for my home OpenVPN server that is built into my Netgear 7000P router. I'm having similar issues with the iOS client and no log information. When the ca.crt, client.crt, client3.key and *.opvpn file are copied over to an ios device and the openvpn connect app the vpn works just fine. I'm also an amateur at .mobileconfig. I've been building it in Apple Configurator 2. I have the two .crt files being imported as certificates, key file as a key/value pair as well as the information in the .opvpn as key/value pairs. without any log data i can't tell what is and isn't working.

my purpose is to create an always on vpn connection anytime my son's iphone is not on our home wifi. so i've figured out the conditional parts of the .mobileconfig to handle that but i feel i need to do something more to the .mobileconfig file that the AC2 program doesn't provided for.

Since im brand new, did i read in other parts of this thread that i will have to include the ca and client as key/value pairs and using \n to keep it all on one line (ugh, was trying to avoid that). So my main question for this thread am i running into a client side bug on the iOS app?

Thanks, trifster

jason.salameh

trifster wrote Hi all...so I stumbled onto this thread trying to make an .mobileconfig file for my home OpenVPN server that is built into my Netgear 7000P router. I'm having similar issues with the iOS client and no log information. When the ca.crt, client.crt, client3.key and *.opvpn file are copied over to an ios device and the openvpn connect app the vpn works just fine. I'm also an amateur at .mobileconfig. I've been building it in Apple Configurator 2. I have the two .crt files being imported as certificates, key file as a key/value pair as well as the information in the .opvpn as key/value pairs. without any log data i can't tell what is and isn't working.

my purpose is to create an always on vpn connection anytime my son's iphone is not on our home wifi. so i've figured out the conditional parts of the .mobileconfig to handle that but i feel i need to do something more to the .mobileconfig file that the AC2 program doesn't provided for.

Since im brand new, did i read in other parts of this thread that i will have to include the ca and client as key/value pairs and using \n to keep it all on one line (ugh, was trying to avoid that). So my main question for this thread am i running into a client side bug on the iOS app?

Thanks, trifster

Be careful, I Believe Netgear uses MD5 to sign as opposed to SHA. They're trying to update this now...

trifster

jason.salameh wrote
trifster wrote Hi all...so I stumbled onto this thread trying to make an .mobileconfig file for my home OpenVPN server that is built into my Netgear 7000P router. I'm having similar issues with the iOS client and no log information. When the ca.crt, client.crt, client3.key and *.opvpn file are copied over to an ios device and the openvpn connect app the vpn works just fine. I'm also an amateur at .mobileconfig. I've been building it in Apple Configurator 2. I have the two .crt files being imported as certificates, key file as a key/value pair as well as the information in the .opvpn as key/value pairs. without any log data i can't tell what is and isn't working.

my purpose is to create an always on vpn connection anytime my son's iphone is not on our home wifi. so i've figured out the conditional parts of the .mobileconfig to handle that but i feel i need to do something more to the .mobileconfig file that the AC2 program doesn't provided for.

Since im brand new, did i read in other parts of this thread that i will have to include the ca and client as key/value pairs and using \n to keep it all on one line (ugh, was trying to avoid that). So my main question for this thread am i running into a client side bug on the iOS app?

Thanks, trifster
Be careful, I Believe Netgear uses MD5 to sign as opposed to SHA. They're trying to update this now...

Thanks. I'm less worried about privacy and more looking to keep kids cellular through my parental-controls enabled home network. With respect to MD5 vs SHA (im fully aware MD5 is compromised) does it change anything i have to specify in my .mobileconfig file?

Micky42

CHRISLINDSAY wrote Managed to get back up and running using a custom ovpn file, not ideal but should keep everyone up and running until this fix gets done by OpenVPN.

Is there a time schedule for fixing this issue? I have the same problem here with my mobileconfig.

iPhrankie

Yes, any ETA would be welcome. Our organization is offline. We are approaching 3 weeks with being offline.

ordex

iPhrankie wrote Yes, any ETA would be welcome. Our organization is offline. We are approaching 3 weeks with being offline.

The next release should be out soon (Apple has been quite slow on this round). Re-enabling .p12 payloads should go in the release right after.

However, in the meantime, doesn't embedding key/cert in the .mobileconfig work for you? Or if you need to use a .p12, why not uploading a separate profile (non mobileconfig) and ovpn12 file?

Micky42

ordex wrote However, in the meantime, doesn't embedding key/cert in the .mobileconfig work for you? Or if you need to use a .p12, why not uploading a separate profile (non mobileconfig) and ovpn12 file?

No, my mobileconfigs donot work any more - we have approx 600 devices running with 140 OpenVpn Servers.
Our procedure in the past was.
1. sending an cert-File and
2. using an integrated complete mobileconfig

I must admit, I was not responsible for the VPN stuff in the past, but unfortunately now I am.
As far as I know, this mobileconfig was somehow generated with an Mac/iTunes and only the relevant parts are changed during config process. This has been working til version 1.2.5

I made an experienent with changing

<key>VPNSubType</key>
<string>net.openvpn.OpenVPN-Connect.vpnplugin</string>

to t

<key>VPNSubType</key>
<string>net.openvpn.connect.app</string>

as I read somewhere here, but this didnot make any difference.

I also did seperate uploading a p12 file, a ovpn12 file and a cert file, but this didnot connect properly, either. At least I saw there, that the client tried to connect to the servers, whereas in the other case (mobileconfig), nothing can be seen in the log (as reported other users before).
I hope there is a chance to avoid updating the 140 Severs (who provide the configs via webserver) and the 600 Clients.

trifster

Micky42 wrote
ordex wrote However, in the meantime, doesn't embedding key/cert in the .mobileconfig work for you? Or if you need to use a .p12, why not uploading a separate profile (non mobileconfig) and ovpn12 file?
No, my mobileconfigs donot work any more - we have approx 600 devices running with 140 OpenVpn Servers.
Our procedure in the past was.
1. sending an cert-File and
2. using an integrated complete mobileconfig

I must admit, I was not responsible for the VPN stuff in the past, but unfortunately now I am.
As far as I know, this mobileconfig was somehow generated with an Mac/iTunes and only the relevant parts are changed during config process. This has been working til version 1.2.5

I made an experienent with changing
<key>VPNSubType</key>
<string>net.openvpn.OpenVPN-Connect.vpnplugin</string>
to t
<key>VPNSubType</key>
<string>net.openvpn.connect.app</string>
as I read somewhere here, but this didnot make any difference.

I also did seperate uploading a p12 file, a ovpn12 file and a cert file, but this didnot connect properly, either. At least I saw there, that the client tried to connect to the servers, whereas in the other case (mobileconfig), nothing can be seen in the log (as reported other users before).
I hope there is a chance to avoid updating the 140 Severs (who provide the configs via webserver) and the 600 Clients.

Micky, Spend the time to get ovpnmcgen.rb working and use it to generate the .mobileconfig. its handling of sucking in the certs/keys got me working. be sure to install with the --pre option (gem install ovpnmcgen.rb --pre). https://github.com/iphoting/ovpnmcgen.rb

Trifster

Micky42

Hi Trifster,
thanks for the hint. I tried - just for a test - to install this (it did) but I have no idea of howto start this ruby-Script after installing on my Linux machine. I have no ruby expierience at all...

trifster

Micky42 wrote Hi Trifster,
thanks for the hint. I tried - just for a test - to install this (it did) but I have no idea of howto start this ruby-Script after installing on my Linux machine. I have no ruby expierience at all...

Same here, never used ruby before ever. i just typed ovpnmcgen.rb followed by the arguments and it worked. This is on macOS High Sierra. Here's the command i used:

ovpnmcgen.rb generate --v12compat --host dynamic_hostename.ddns.net --port 12973 --proto udp --cafile ca.crt --cert client.crt --key client.key --vod --trusted-ssids TrifNet5,TrifNet2.4 --security-level medium --url-probe https://www.apple.com/ --ovpnconfigfile client3.ovpn --output TrifHome2.mobileconfig trifster iphone

One note, i ran this from a folder where all the files were located together so i didn't have to specify paths above.

Micky42

Ok. I will try to install it on a windows machine.

Micky42

Under windows I could install and execute the ruby file. The config file seems (at a first sight) to be same as my old but the p12 was there integrated in the config. I didnot test the new one, but is the p12 Certifcate in the config the problem?

trifster

Micky42 wrote Under windows I could install and execute the ruby file. The config file seems (at a first sight) to be same as my old but the p12 was there integrated in the config. I didnot test the new one, but is the p12 Certifcate in the config the problem?

From what i've been reading in this thread is that the fix for 1.2.x client issues is that it needs to be in the .mobileconfig file. I don't have a p12 file in my usage so you may need to see if there is a different way to handle that.

« Previous Page Next Page »