Sophos SSL VPN unable to get local issuer certificate

Question

Hallo, 
 ich habe gestern unser neues Mailserver-Zertfikat inkl. CA in unsere UTM 9 hochgeladen. Dabei hat es irgendwie unsere VPN-Konfiguration zerissen. Es ist nun nicht mehr m&ouml;glich per SSL-VPN zu connecten. 
 Auch das L&ouml;schen und neu Anlegen des Benutzers inkl. Aktualisierung des SSL-VPN Clients hat das Problem nicht gel&ouml;st. 
 Hinter allen Zertifkaten steht (regenerated). Auch hinter dem unter SSL -> Erweitert -> Serverzertifikat. 
 Hier der Log des Clients. 
 Wed Mar 04 08:27:02 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340Wed Mar 04 08:27:02 2020 Need hold release from management interface, waiting... 
 Wed Mar 04 08:27:03 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Wed Mar 04 08:27:03 2020 MANAGEMENT: CMD 'state on' Wed Mar 04 08:27:03 2020 MANAGEMENT: CMD 'log all on' Wed Mar 04 08:27:03 2020 MANAGEMENT: CMD 'hold off' Wed Mar 04 08:27:03 2020 MANAGEMENT: CMD 'hold release' Wed Mar 04 08:27:10 2020 MANAGEMENT: CMD 'username "Auth" "Username"' Wed Mar 04 08:27:10 2020 MANAGEMENT: CMD 'password [...]' Wed Mar 04 08:27:10 2020 Socket Buffers: R=[65536->65536] S=[65536->65536] Wed Mar 04 08:27:10 2020 Attempting to establish TCP connection with [AF_INET]externeip:9999 [nonblock] Wed Mar 04 08:27:10 2020 MANAGEMENT: >STATE:1583306830,TCP_CONNECT,,,,,, Wed Mar 04 08:27:11 2020 TCP connection established with [AF_INET]externeip:9999 Wed Mar 04 08:27:11 2020 TCPv4_CLIENT link local: [undef] Wed Mar 04 08:27:11 2020 TCPv4_CLIENT link remote: [AF_INET]externeIP:9999 Wed Mar 04 08:27:11 2020 MANAGEMENT: >STATE:1583306831,WAIT,,,,,, Wed Mar 04 08:27:11 2020 MANAGEMENT: >STATE:1583306831,AUTH,,,,,, Wed Mar 04 08:27:11 2020 TLS: Initial packet from [AF_INET]130.180.41.78:9999, sid=89111f07 be5927da Wed Mar 04 08:27:11 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Wed Mar 04 08:27:11 2020 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=DE, L=Ort, O=Firma, CN=utm.unseredomain.de, emailAddress=technik@unseredomain.de Wed Mar 04 08:27:11 2020 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Wed Mar 04 08:27:11 2020 TLS Error: TLS object -> incoming plaintext read error Wed Mar 04 08:27:11 2020 TLS Error: TLS handshake failed Wed Mar 04 08:27:11 2020 Fatal TLS error (check_tls_errors_co), restarting Wed Mar 04 08:27:11 2020 SIGUSR1[soft,tls-error] received, process restarting Wed Mar 04 08:27:11 2020 MANAGEMENT: >STATE:1583306831,RECONNECTING,tls-error,,,,, Wed Mar 04 08:27:11 2020 Restart pause, 5 second(s) 
 
 Wie kann ich das Problem l&ouml;sen? 
 MfG

BAlfson · Answer

Hallo Andy, 
 (Sorry, my German-speaking brain isn't creating thoughts at the moment. ) 
 ** Standard warning about CLI changes on a UTM with a paid license. ** 
 You can get a list of the names of regenerated certs with: 
 cc get_objects ca host_key_cert|grep regenerated 
 One of the ones I got with that was 'name' => 'astaro (X509 User Cert) (regenerated) (regenerated)' , so I got the REF_ for it with: 
 cc get_object_by_name ca host_key_cert 'astaro (X509 User Cert) (regenerated) (regenerated)' |grep ref 
 The response was 'ref' => 'REF_XEqiZtSzBM' , so I changed the name with: 
 cc change_object REF_XEqiZtSzBM name 'astaro (X509 User Cert)' 
 MfG - Bob (Bitte auf Deutsch weiterhin.)

BAlfson · Answer

(Sorry, my German-speaking brain isn't creating thoughts at the moment. [:(]) 
 It would have been interesting to see the OpenVPN log lines from the UTM corresponding to this connection attempt. In any case, it sounds like you have regenerated user certificates, but haven't selected the regenerated 'Server certificate' on the 'Advanced' tab of 'SSL'. 
 MfG - Bob (Bitte auf Deutsch weiterhin.)