EC Certificate Support in 1.2.8

jasonsansone

The release notes for OpenVPN Connect version 1.2.8 state the following:

Changes from 1.2.7 to 1.2.8:
* fixed spurious crash on reconnection after sleep
* restored access to CertificatePayloads (p12 bundles) uploaded via Provisioning Profiles (.mobileconfig files)
* show warning pop-up when connecting to server using insecure MD5 algorithm to sign certificates (MD5 support will be dropped end of Apr 2018)
* report unique app specific UUID to server within peer info (variable IV_HWADDR)
* added support for ECDSA ciphersuites (for EC certificates)
* fixed VPN status after closing and re-opening App with tunnel activated (VPN IPs, last event, etc.)
* fixed profiles loading from iCloud with Files app (due to an iOS bug, only 1 file can be loaded at once)
* improved .ovpn12 file import

I have unsuccessfully tried to use EC certificates on iOS 11.2.6 to connect to pfSense 2.4.2 which contains OpenVPN. We maintain a site-to-site VPN but I would like to bring mobile devices over to EC and deprecate our legacy vpn setup.

Client Config:

client
dev tun
remote xxxxxxxxxxx 1196 udp
auth SHA512
cipher AES-256-GCM
tun-mtu 1400
remote-cert-tls server
keepalive 15 60
reneg-sec 3600
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>

Has anyone successfully used EC certificates on iOS? My log hangs right after it gets to the certificates.

Here is the log file.

2018-02-20 15:05:13 ----- OpenVPN Start -----
OpenVPN core 3.1.2 ios arm64 64-bit built on Feb  7 2018 17:16:12
2018-02-20 15:05:13 Frame=512/2048/512 mssfix-ctrl=1250
2018-02-20 15:05:13 EVENT: RESOLVE
2018-02-20 15:05:13 Contacting [xxxxxxxxxxxx]:1196/UDP via UDP
2018-02-20 15:05:13 EVENT: WAIT
2018-02-20 15:05:13 Connecting to [xxxxxxxxxxxx]:1196 (xxxxxxxxxxxx) via UDPv4
2018-02-20 15:05:13 EVENT: CONNECTING
2018-02-20 15:05:13 Tunnel Options:V4,dev-type tun,link-mtu 1421,tun-mtu 1400,proto UDPv4,cipher AES-256-GCM,auth SHA512,keysize 256,key-method 2,tls-client
2018-02-20 15:05:13 Creds: UsernameEmpty/PasswordEmpty
2018-02-20 15:05:13 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.2.8-1
IV_VER=3.1.2
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_IPv6=0
IV_AUTO_SESS=1

2018-02-20 15:05:13 VERIFY OK : depth=1
cert. version    : 3
serial number    : xxxxxxxxxxxx
issuer name      : xxxxxxxxxxxx
subject name      : xxxxxxxxxxxx
issued  on        : 2017-08-23 18:38:17
expires on        : 2027-08-21 18:38:17
signed using      : ECDSA with SHA384
EC key size      : 521 bits
basic constraints : CA=true

2018-02-20 15:05:13 VERIFY OK : depth=0
cert. version    : 3
serial number    : 01
issuer name      : xxxxxxxxxxxx
subject name      : xxxxxxxxxxxx
issued  on        : 2017-08-23 18:40:31
expires on        : 2027-08-21 18:40:31
signed using      : ECDSA with SHA384
EC key size      : 521 bits
basic constraints : CA=false
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

The log just hangs at that point.

aloop

I got EC certs to work on mine, but only after I changed the tls-crypt option back to tls-auth on client and server (and added key-direction to the client profile).

Edit: To add some more info, when using tls-crypt, I was getting the following errors in my server log when attempting to connect:

Tue Feb 20 06:34:55 2018 tls-crypt unwrap error: packet authentication failed                                                                                   
Tue Feb 20 06:34:55 2018 TLS Error: tls-crypt unwrapping failed from [AF_INET]

jasonsansone

Thank you, that helped. Actually I learned after much trial and error that iOS connect doesn't support certificates generated with secp521r1 curve. After I recreated the entire certificate chain with secp384r1 I got it to work.

aloop

Strange, i'm using secp521r1. Or are you saying that tls-crypt works with secp384r1?

ordex

honestly I don't understand how tls-crypt is related to EC - it is a different mechanism that kicks in at the very first packet, even before the certificates are exchanged and verified. Are you guys sure that the problem wasn't somewhere else?

ordex

On a side note: EC certificates only work when embedded in the .ovpn config file and not when imported via .ovpn12 (the latter is WIP)

aloop

I wasn't sure of any link between the two. Something broke tls-crypt for me though, and the only change I made was generating new EC certs.

ordex

aloop wrote I wasn't sure of any link between the two. Something broke tls-crypt for me though, and the only change I made was generating new EC certs.

does it mean that if you go back to the RSA certificates with tls-crypt enabled it works again?

aloop

How odd, I generated new RSA certs and new EC certs with both secp384r1 and secp521r1 curves, and they all worked with tls-crypt. I generated the certs the exact same way too, not sure why it wasn't working before.

jimdoe

ordex wrote On a side note: EC certificates only work when embedded in the .ovpn config file and not when imported via .ovpn12 (the latter is WIP)

Forgive my ignorance, but what is WIP? :oops: Does it mean that EC certs will never be able to support .ovpn12 importing? I would prefer to use the iOS keychain where possible.

ordex

sorry, it means Work In Progress, thus this is something that "will" work later 🙂