OpenVPN 2.1.4. mips could not extract Common Name from X509 subject string

skyph

Hello!
I already have PKI infrastructure, which consist of CA certificate, Intermediate certificate and bunch of server certificates.
CA signs only intermediate certificate, and intermediate signs everything else.

I made new server certificate for OpenVPN as follows:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4157 (0x103d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = RU, ST = Chelyabinskaya oblast, O = OOOO, OU = OOOO Certificate Authority, CN = OOOO Intermediate CA, emailAddress = sysadmin@ooo-com.ru
        Validity
            Not Before: Jul 22 11:38:09 2019 GMT
            Not After : Jul 31 11:38:09 2020 GMT
        Subject: C = RU, ST = Chelyabinskaya oblast, L = Chelyabinsk, O = OOOO, OU = OOOO Certificate Authority, CN = mikrotik.local.ooo-com.ru, emailAddress = sysadmin@ooo-com.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c1:4b:25:bd:b0:4b:aa:93:79:b5:dd:dc:86:9e:
                    ...
                    9e:03
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Cert Type: 
                SSL Server
            Netscape Comment: 
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier: 
                57:0E:0B:E0:14:54:C2:E8:8F:38:A9:39:A6:48:EE:B5:BE:3F:76:05
            X509v3 Authority Key Identifier: 
                keyid:0C:42:99:EB:10:87:20:F6:04:11:C3:35:AC:D0:D3:61:26:41:D7:8E
                DirName:/C=RU/ST=Chelyabinskaya oblast/L=Chelyabinsk/O=OOOO/OU=OOOO Certificate Authority/CN=OOOO Root CA/emailAddress=sysadmin@ooo-com.ru
                serial:10:00

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Subject Alternative Name: 
                DNS:mikrotik.local.ooo-com.ru
    Signature Algorithm: sha256WithRSAEncryption

then, I made client certificate as follows:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4197 (0x1065)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = RU, ST = Chelyabinskaya oblast, O = OOOO, OU = OOOO Certificate Authority, CN = OOOO Intermediate CA, emailAddress = sysadmin@ooo-com.ru
        Validity
            Not Before: Apr 20 08:07:05 2020 GMT
            Not After : Apr 30 08:07:05 2021 GMT
        Subject: C = RU, ST = Chelyabinskaya oblast, L = Chelyabinsk, O = OOOO, OU = OOOO Certificate Authority, CN = th0000.local.ooo-com.ru, emailAddress = sysadmin@ooo-com.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:fd:ae:31:1b:fa:45:de:bf:de:7a:28:2d:a5:
                    ...
                    e2:f3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Cert Type: 
                SSL Client, S/MIME
            Netscape Comment: 
                OpenSSL Generated Client Certificate
            X509v3 Subject Key Identifier: 
                A4:63:FE:3C:9C:AA:3C:CE:70:1C:D4:C9:F9:93:76:05:21:4E:57:89
            X509v3 Authority Key Identifier: 
                keyid:0C:42:99:EB:10:87:20:F6:04:11:C3:35:AC:D0:D3:61:26:41:D7:8E

            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption

These certificates are working with OpenVPN 2.1.4 to 2.4.7 (AMD64).
The problem is I have a client with OpenVPN 2.4.1 (mips) and when he tries to connect to OpenVPN server I get the error:

[olog]openvpn[701]: VERIFY OK: depth=2, /C=RU/ST=Chelyabinskaya_oblast/L=Chelyabinsk/O=OOOO/OU=OOOO_Certificate_Authority/CN=OOOO_Root_CA/emailAddress=sysadmin@ooo-com.ru
openvpn[701]: VERIFY OK: depth=1, /C=RU/ST=Chelyabinskaya_oblast/O=OOOO/OU=OOOO_Certificate_Authority/CN=OOOO_Intermediate_CA/emailAddress=sysadmin@ooo-com.ru
openvpn[701]: VERIFY ERROR: could not extract Common Name from X509 subject string ('/C=RU/ST=Chelyabinskaya_oblast/O=OOOO/OU=OOOO_Certificate_Authority/CN=ovpn02/name=ovpn02/emailAddress=sysadmin@ooo-com.ru') -- note that the Common N[/olog]

Common name is obviously there, so the error must be about something else.

My server config:

dev tun
proto tcp
port 443
ca /etc/openvpn/server/oooca/ca.pem
cert /etc/openvpn/server/oooca/server.cert.pem
key /etc/openvpn/server/oooca/server.key.pem
dh dh4096.pem
topology subnet
server 172.31.0.0 255.255.0.0
cipher DES-CBC
tls-version-min 1.0 
verb 3

Client config:

client
dev tun
dev-type tun
proto tcp
mute 20
remote ovpn02 443
auth-retry nointeract
ns-cert-type server
setenv SERVER_POLL_TIMEOUT 4
reneg-sec 604800
sndbuf 1000000
rcvbuf 1000000
verb 3
ca /config/openvpn/ca.crt
cert /config/openvpn/clients.crt
key /config/openvpn/clients.key

What can I do to fix this issue with OpenVPN 2.1.4 on mips? Sadly, I cannot update OpenVPN version on this device :cry:

TinCanTech

skyph wrote These certificates are working with OpenVPN 2.1.4 to 2.4.7 (AMD64).
The problem is I have a client with OpenVPN 2.4.1 (mips)

Probably some underlying dependency, maybe openssl ..

skyph wrote What can I do to fix this issue with OpenVPN 2.1.4 on mips?

I expect you will have to find the bug and edit the source code.

You could try reporting this to the devs but don't expect too much as 2.1.4 is from 2013