OVPN Inline vs External

pvcflyer

Not sure if this is the correct place to post this, however here is my situation. I have a server setup on windows and a client that is an iPhone. When I use an OVPN file with externally referenced cert/key files the tunnel connects correctly. When I use an OVPN file with inline cert/key files the tunnel won't connect. Everything else about two OVPN files is identical.

I think this has something to do with the tls-crypt cert not working when it is included in the OVPN file, but does when it is referenced. Has anyone else had a similar experience?

PC

pvcflyer

Follow up with some details from the server log (didn't think to check with my first post).

Wed Dec 25 11:09:02 2019 100.38.138.95:57753 TLS: Initial packet from [AF_INET6]
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 VERIFY OK: depth=1, 
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 VERIFY OK: depth=0, 
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 TLS_ERROR: BIO read tls_read_plaintext error
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 TLS Error: TLS object -> incoming plaintext read error
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 TLS Error: TLS handshake failed
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 SIGUSR1[soft,tls-error] received, client-instance restarting

The above entries show up when trying to connect with the OVPN with inline cert/key files.

PC

TinCanTech

pvcflyer wrote Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed
Wed Dec 25 11:09:03 2019 100.38.138.95:57753 OpenSSL: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature

Looks like something is wrong with your client certificate.

Please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

pvcflyer

If there was something wrong with any of the certificates why would they work when separated out of the OVPN file?

I made a new connection on my iPhone with all the files separately dumped in via iTunes and it works correctly. This is not ideal however because it makes setting up other iPhones (read not mine) impossible as there isn't a way to get the files to them individually.

I hope I am not over looking something simple.

PC

TinCanTech

pvcflyer wrote there was something wrong with any of the certificates why would they work when separated out of the OVPN file?

Maybe line endings .. ? How did you create the Inline config ?

We really need configs and logs at --verb 4