Hello,
my Mac (10.13.6 high sierra) can't authenticate with my VPN server over WAN. Windows and iOS clients are working fine.
Lengthy & detailed description:
I'm running an AS VM (2.6) on my LAN at a fixed IP using hyper-v. I've setup the external PKI using my own CA and used the db tool to set the default server certificate and CA (issued to OpenVPN) to my own.
Clients' OS must present a cert signed by the CA that has the authorized username (for the AS) as its CN.
My router uses DDNS and port forwarding to allow WAN traffic into the VPN over my domain.
I imported my CA and client cert into the Keychain both under login and System (I had to, OVPN wouldn't find it).
Upon providing credentials, the connection closes and the client signals its error state.
Looking at the logs, I'm seeing this
2019-04-11 13:59:23-0400 [-] *** openvpn-sign returned (0, ['{', ' "error": "CSSM_SignData: CSSMERR_CSP_NO_USER_INTERACTION (-2147415840)", ', ' "status": "OPENVPN_SIGN", ', ' "traceback": "pki/epkisign:55,mac/keychain:50,<string>:1,mac/cliapi_entry:35,pki/epkisign:71,util/options:79,pki/epkisign:55,mac/keychain:50,util/error:61,util/error:44"', '}'], [])
2019-04-11 13:59:23-0400 [-] *** API CALL f=xmlrpc_Poll args=['sess_REDACTED_com_externalpki_p8060_tHsWstArTZcMqpu7_1', 10] kw={} ret=[{'timestamp': 1555005563, 'type': 'RSA_SIGN', 'error': 'rsa_signature_request: ExternalKeyAgent: CSSM_SignData: CSSMERR_CSP_NO_USER_INTERACTION (-2147415840) (OPENVPN_SIGN)'}]
2019-04-11 13:59:23-0400 [-] rsa_signature_request: ExternalKeyAgent: CSSM_SignData: CSSMERR_CSP_NO_USER_INTERACTION (-2147415840) (OPENVPN_SIGN)
2019-04-11 13:59:23-0400 [-] TO OMI: ['exit']
2019-04-11 13:59:24-0400 [MyOMIClient,0,] OMI Cancel pending deferred ['exit']
What does this mean? I tried Googling the CSSMERR_ constant but found nothing that resolved the issue.
EDIT: if it helps I have the private key of the client cert installed in the chain as well. (Pfx password encoded)
Any advice or help would be appreciated. Thank you
