Hello all, There have been some references to a workaround to the current VoD/pkcs issue in 1.2.6. Some people have claimed that have found a workaround by using inline certs and keys. To clarify this for myself and others, has anyone gotten this to work with inline certs and keys IN A MOBILECONFIG FILE? I've gotten it to work on an imported openvpn config autologin profile, but when I transfer the exact same information to an apple mobileconfig, it doens't work (I've already implemented the \n). The VoD feature does not work with openvpn configs, and what I'm really after is getting the on Demand part to work. If anyone has gotten an mobileconfig with inline cert and key and VPN on Demand to work, would they be willing to share any tips and perhaps post a sample mobileconfig? Thanks.

What do you mean by doesn’t work? Fail to install the profile into iOS or that the VPN fails to come up according to your OnDemand rules?

Everything installs fine, the on demand initiates, but it just hangs on "connecting..." There's no detail in the openvpn connect log, so I can't figure out any more specifics.

Well, it looks like the mobileconfig and VoD potions are functioning. What do you mean by “autologin” profile? Sent from my iPad using Tapatalk

Same issue as me however I cant get my profile installed Using the same certs etc as before I upgraded to 1.2.6 Ive escaped all line breaks with \\n (double slash) as per FAQ's on Openvpn site and followed the other FAQ's Connection Name should be set to a name that will identity this profile on the device. Connection Type should be set to Custom SSL. Identifier should be set to "net.openvpn.connect.app". (on older versions this used to be net.openvpn.OpenVPN-Connect.vpnplugin). Server can be set to a hostname, or "DEFAULT" to use the hostname(s) from the OpenVPN configuration. User Authentication should be set to Certificate, and the client certificate+key should be attached as a PKCS#12 file. VPN On Demand should be enabled and match entries should be defined to instruct iOS under which conditions the VPN profile should be automatically connected. However it still says in logs that my certs are invalid and then the profile fails to install. Does anyone have a working template example of how their mobileconfig file looks like now that works, someone preferably that had an embedded p12 cert previously working thats now borken in 1.2.6

[quote=CHRISLINDSAY post_id=76157 time=1516282096 user_id=43054] Does anyone have a working template example of how their mobileconfig file looks like now that works, someone preferably that had an embedded p12 cert previously working thats now borken in 1.2.6 [/quote] There's an example posted here: https://github.com/iphoting/ovpnmcgen.rb/pull/12#issuecomment-357419649 Personally, my mobileconfigs pushed via MDM include both .p12 and inline cert + key components to workaround this issue currently.

So you have the p12 added through apple configurator in certificates and then inline also? Did you change the identifier, server and user authentication as per FAQ's? If possible could you send me your example if possible, im tearing my hair out here

[quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] So you have the p12 added through apple configurator in certificates and then inline also? [/quote] Yes. For easier transition when the bug/limitation gets fixed. [quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Migrating from OpenVPN Connect v1.1.1 to v1.2.x, the changes required are 1) the "identifier" to net.openvpn.connect.app, and 2) additionally including the contents of the .p12 payload inline as cert and key. [quote=CHRISLINDSAY post_id=76160 time=1516284177 user_id=43054] If possible could you send me your example if possible, im tearing my hair out here [/quote] My configs are generated using my tool. But for your reference, here's a generated generic version: [code] PayloadContent PayloadDescription Configures VPN settings, including authentication. PayloadDisplayName VPN (vpn.example.com/VoD) PayloadIdentifier com.example.vpn.example-iphone.vpnconfig PayloadOrganization vpn.example.com PayloadType com.apple.vpn.managed PayloadUUID 2D973388-1012-4175-ACA0-C4064A16ABF3 PayloadVersion 1 UserDefinedName vpn.example.com/VoD VPN AuthenticationMethod Certificate OnDemandEnabled 1 OnDemandRules Action Disconnect InterfaceTypeMatch WiFi SSIDMatch home Action Connect InterfaceTypeMatch WiFi Action Ignore InterfaceTypeMatch Cellular Action Ignore PayloadCertificateUUID 75C3B20C-8067-4EE1-8DB2-598F92E26B2B RemoteAddress DEFAULT VPNSubType net.openvpn.connect.app VPNType VPN VendorConfig ca Contents of CA file\nWith newlines\nAnd more newlines\nThat should appear as one line cert Contents of cert file\nWith newlines\nAnd more newlines\nThat should appear as one line client NOARGS comp-lzo NOARGS dev tun key Contents of key file\nWith newlines\nAnd more newlines\nThat should appear as one line key-direction 1 remote vpn.example.com 1194 tcp remote-cert-tls server tls-auth Contents of TLS-Auth Key file\nWith newlines\nAnd more newlines\nThat should appear as one line Password password PayloadCertificateFileName example-iphone.p12 PayloadContent cDEyZmlsZSB0aGF0IHNob3VsZCBhcHBlYXIKSW4gYmFzZTY0IGVuY29kaW5n IGFzIDxkYXRhLz4= PayloadDescription Provides device authentication (certificate or identity). PayloadDisplayName example-iphone.p12 PayloadIdentifier com.example.vpn.example-iphone.credential PayloadOrganization vpn.example.com PayloadType com.apple.security.pkcs12 PayloadUUID 75C3B20C-8067-4EE1-8DB2-598F92E26B2B PayloadVersion 1 PayloadDescription OpenVPN Configuration Payload for example-iphone@vpn.example.com PayloadDisplayName vpn.example.com OpenVPN example@iphone PayloadIdentifier com.example.vpn.example-iphone PayloadOrganization vpn.example.com PayloadRemovalDisallowed PayloadType Configuration PayloadUUID A00F372B-49C3-45D4-8C08-AD62076A5BF4 PayloadVersion 1 [/code]

Many thanks its much appreciated. So you only use \n and then make sure its all in one line within a text editor? Did you change the identifier, server and user authentication as per FAQ's?

[quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] So you only use \n and then make sure its all in one line within a text editor? [/quote] Yes. The \\n is probably required only when using Apple Configurator? [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Please see my edited post above: https://forums.openvpn.net/viewtopic.php?f=36&t=25664&p=76164#p76162

[quote=iphoting post_id=76164 time=1516285632 user_id=22554] [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] So you only use \n and then make sure its all in one line within a text editor? [/quote] Yes. The \\n is probably required only when using Apple Configurator? [quote=CHRISLINDSAY post_id=76163 time=1516285195 user_id=43054] Did you change the identifier, server and user authentication as per FAQ's? [/quote] Please see my edited post above: https://forums.openvpn.net/viewtopic.php?f=36&t=25664&p=76164#p76162 [/quote] Maybe the FAQ is not 100% clear - I'll ask to revise it a bit. Basically it says: [quote]The procedure is to convert the multi-line data to a single line by replacing line breaks with "\n" (without the quotes). Note that because of this escaping model, you must use "\\" to pass backslash itself.[/quote] Which means you have to use "\n" for line break and "\\" when you need a \. It's a way to escape special characters.

VPN On Demand - 1.2.6

iphoting

Micky42 wrote Under windows I could install and execute the ruby file. The config file seems (at a first sight) to be same as my old but the p12 was there integrated in the config. I didnot test the new one, but is the p12 Certifcate in the config the problem?

The breaking changes/bugs in the currently released OpenVPN Connect v1.2.6, with respect to mobileconfig and VPN-on-Demand, require the following 3 changes:
- VPNSubType changed to net.openvpn.connect.app. (--v12compat flag of the tool)
- .p12 certificate bundles must be exported and included inline as cert and unencrypted key entries (--key and --cert flags of the tool).
- TCP connections are broken, use only UDP.

Hope this helps!

ordex

iphoting wrote The breaking changes/bugs in the currently released OpenVPN Connect v1.2.6, with respect to mobileconfig and VPN-on-Demand, require the following 3 changes:
- VPNSubType changed to net.openvpn.connect.app. (--v12compat flag of the tool)

for the time being, also the old ID should still work because we have some kind of "compatibility mode", but it's good to switch to the new ID as soon as possible.

iphoting wrote - .p12 certificate bundles must be exported and included inline as cert and unencrypted key entries (--key and --cert flags of the tool).

I can tell you this will be finally fixed in v1.2.8 :-)

iphoting wrote - TCP connections are broken, use only UDP.

this is fixed in v1.2.7 (released to the public a few hours ago)

iPhrankie

ordex wrote
iphoting wrote - .p12 certificate bundles must be exported and included inline as cert and unencrypted key entries (--key and --cert flags of the tool).
I can tell you this will be finally fixed in v1.2.8 :-)

Is this already waiting for approval in the App store? Or are you guys still working on it?

We'll wait for v1.2.8 if you think it will be soon. Otherwise we'll need to decide deploying the workaround to everyone.

Thanks.

ordex

iPhrankie wrote Is this already waiting for approval in the App store? Or are you guys still working on it?

It still needs work. I wouldn't make any assumption on its date of release, as we obviously also want to include any fix for bugs reported by 1.2.7 users.

ordex

ordex wrote
iPhrankie wrote Is this already waiting for approval in the App store? Or are you guys still working on it?
It still needs work. I wouldn't make any assumption on its date of release, as we obviously also want to include any fix for bugs reported by 1.2.7 users.

You could still join the beta program if you wish to be an early adopter.

Micky42

ordex wrote It still needs work. I wouldn't make any assumption on its date of release, as we obviously also want to include any fix for bugs reported by 1.2.7 users.

I know, this is a bit inpatient, but is the date of release already near?

ordex

Hi there, 1.2.8 is under review by Apple since several days already. So I'd expect it to be out soon.

Micky42

Great news, thanks! I hope this fixes the issues with the migration from 1.1.x to 1.2.x :-)

ordex

1.2.8 is out, please test it 🙂 If there are bugs, please report them on the bug tracker. Thanks!

Micky42

Great Work!
The old config works again in all of my clients. An re-installation on the devices was necessary to make it work, nevertheless.
Thanks

ordex

glad to hear that! 🙂

« Previous Page