This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN - Not working after upgrade to UTM 9

Hello together,

I upgraded from ASG 8.305 to UTM 9. When wanting to connect via SSL VPN I see the following error in the Log of the SSL VPN client which is updated, too:

VERIFY X509NAME ERROR: C=de, L=***, O=*** MÃ¶ssner, CN=***, emailAddress=***, must be C=de, L=***, O=*** Mössner, CN=***, emailAddress=***

You can see that there is difference for the "O" field. The certificates were imported from the ASG installation where the SSL VPN worked fine.

When looking into the certificates on the UTM 9 and on the client, the "O" field looks good, there is no problem with vowel mutation.

So my question is: Which certificate is presented with the wrong information? Is it the certifacte of the SSL VPN client or is it the CA certificate of the UTM 9 and what can I do to correct the issue without resigning the HTTPS proxy certificate and all the other certificates?

Thank you

TheExpert

This thread was automatically locked due to age.

Parents

0 d12fk over 11 years ago

A CN in the user certificate is required. Assign a cert with a CN and it will work.
Cancel
Vote Up 0 Vote Down

Cancel
0 samuel.heinrich over 11 years ago in reply to d12fk

A CN in the user certificate is required. Assign a cert with a CN and it will work.

The X509 i used already contained a CN:

admin (X509 User Cert) (regenerated) (regenerated) (regenerated) (regenerated) (regenerated)
VPNId [Distinguished name] C=ch, L=Sissach, O=***x AG, CN=admin
Valid from Feb 8 10:31:37 2013 GMT through Jan 1 00:00:01 2038 GMT
Fingerprint 03:*64:*43:*5D:*1F:*0B:*60:*C9:*A0:*DA:*67:*73:*B2:*2D:*05:*B3:*2F:*4C:*43:*CB

I forgot to mention, that we noticed this issue after uprading to 9.107-33 on many UTM's.. at least on 3 different customer sites.

for the sake I created a new certificate:

Adminx509
VPNId [Distinguished name] C=ch, ST=Sissach, L=Sissach, O=***x AG, OU=LocalAdmin, CN=***x AG
Valid from Jan 29 15:06:05 2014 GMT through Jan 1 00:00:01 2038 GMT
Fingerprint 42:*5A:*4A:*F2:*89:*4C:*1B:*FB:*7C:*8F:*2F:*B0:*A6:*F7:*6E:*4F:*0C:*31:*C0:*72

Unfortunatelly I still got the same error message:

Wed Jan 29 15:54:49 2014 OpenVPN 2.3.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jun 14 2013
Wed Jan 29 15:54:49 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25347
Wed Jan 29 15:54:49 2014 Need hold release from management interface, waiting...
Wed Jan 29 15:54:49 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25347
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'state on'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'log all on'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'hold off'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'hold release'
Wed Jan 29 15:54:55 2014 MANAGEMENT: CMD 'username "Auth" "admin"'
Wed Jan 29 15:54:56 2014 MANAGEMENT: CMD 'password [...]'
Wed Jan 29 15:54:56 2014 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Wed Jan 29 15:54:56 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 29 15:54:56 2014 Socket Buffers: R=[65536->65536] S=[64512->64512]
Wed Jan 29 15:54:56 2014 MANAGEMENT: >STATE:1391007296,RESOLVE,,,
Wed Jan 29 15:54:56 2014 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Wed Jan 29 15:54:56 2014 MANAGEMENT: >STATE:1391007296,TCP_CONNECT,,,
Wed Jan 29 15:54:57 2014 TCP connection established with [AF_INET]x.x.x.x:443
Wed Jan 29 15:54:57 2014 TCPv4_CLIENT link local: [undef]
Wed Jan 29 15:54:57 2014 TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:443
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,WAIT,,,
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,AUTH,,,
Wed Jan 29 15:54:57 2014 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=0fcd8d6f 89cff321
Wed Jan 29 15:54:57 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jan 29 15:54:57 2014 VERIFY OK: depth=1, C=ch, L=Sissach, O=FIRMA AG, CN=FIRMA AG VPN CA, emailAddress=email@email.com
Wed Jan 29 15:54:57 2014 VERIFY ERROR: could not extract CN from X509 subject string ('C=ch, L=Sissach, O=FIRMA AG') -- note that the username length is limited to 64 characters
Wed Jan 29 15:54:57 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Jan 29 15:54:57 2014 TLS Error: TLS object -> incoming plaintext read error
Wed Jan 29 15:54:57 2014 TLS Error: TLS handshake failed
Wed Jan 29 15:54:57 2014 Fatal TLS error (check_tls_errors_co), restarting
Wed Jan 29 15:54:57 2014 SIGUSR1[soft,tls-error] received, process restarting
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,RECONNECTING,tls-error,,
Wed Jan 29 15:54:57 2014 Restart pause, 5 second(s)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 samuel.heinrich over 11 years ago in reply to d12fk

A CN in the user certificate is required. Assign a cert with a CN and it will work.

The X509 i used already contained a CN:

admin (X509 User Cert) (regenerated) (regenerated) (regenerated) (regenerated) (regenerated)
VPNId [Distinguished name] C=ch, L=Sissach, O=***x AG, CN=admin
Valid from Feb 8 10:31:37 2013 GMT through Jan 1 00:00:01 2038 GMT
Fingerprint 03:*64:*43:*5D:*1F:*0B:*60:*C9:*A0:*DA:*67:*73:*B2:*2D:*05:*B3:*2F:*4C:*43:*CB

I forgot to mention, that we noticed this issue after uprading to 9.107-33 on many UTM's.. at least on 3 different customer sites.

for the sake I created a new certificate:

Adminx509
VPNId [Distinguished name] C=ch, ST=Sissach, L=Sissach, O=***x AG, OU=LocalAdmin, CN=***x AG
Valid from Jan 29 15:06:05 2014 GMT through Jan 1 00:00:01 2038 GMT
Fingerprint 42:*5A:*4A:*F2:*89:*4C:*1B:*FB:*7C:*8F:*2F:*B0:*A6:*F7:*6E:*4F:*0C:*31:*C0:*72

Unfortunatelly I still got the same error message:

Wed Jan 29 15:54:49 2014 OpenVPN 2.3.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jun 14 2013
Wed Jan 29 15:54:49 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25347
Wed Jan 29 15:54:49 2014 Need hold release from management interface, waiting...
Wed Jan 29 15:54:49 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25347
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'state on'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'log all on'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'hold off'
Wed Jan 29 15:54:49 2014 MANAGEMENT: CMD 'hold release'
Wed Jan 29 15:54:55 2014 MANAGEMENT: CMD 'username "Auth" "admin"'
Wed Jan 29 15:54:56 2014 MANAGEMENT: CMD 'password [...]'
Wed Jan 29 15:54:56 2014 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Wed Jan 29 15:54:56 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 29 15:54:56 2014 Socket Buffers: R=[65536->65536] S=[64512->64512]
Wed Jan 29 15:54:56 2014 MANAGEMENT: >STATE:1391007296,RESOLVE,,,
Wed Jan 29 15:54:56 2014 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Wed Jan 29 15:54:56 2014 MANAGEMENT: >STATE:1391007296,TCP_CONNECT,,,
Wed Jan 29 15:54:57 2014 TCP connection established with [AF_INET]x.x.x.x:443
Wed Jan 29 15:54:57 2014 TCPv4_CLIENT link local: [undef]
Wed Jan 29 15:54:57 2014 TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:443
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,WAIT,,,
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,AUTH,,,
Wed Jan 29 15:54:57 2014 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=0fcd8d6f 89cff321
Wed Jan 29 15:54:57 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jan 29 15:54:57 2014 VERIFY OK: depth=1, C=ch, L=Sissach, O=FIRMA AG, CN=FIRMA AG VPN CA, emailAddress=email@email.com
Wed Jan 29 15:54:57 2014 VERIFY ERROR: could not extract CN from X509 subject string ('C=ch, L=Sissach, O=FIRMA AG') -- note that the username length is limited to 64 characters
Wed Jan 29 15:54:57 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Jan 29 15:54:57 2014 TLS Error: TLS object -> incoming plaintext read error
Wed Jan 29 15:54:57 2014 TLS Error: TLS handshake failed
Wed Jan 29 15:54:57 2014 Fatal TLS error (check_tls_errors_co), restarting
Wed Jan 29 15:54:57 2014 SIGUSR1[soft,tls-error] received, process restarting
Wed Jan 29 15:54:57 2014 MANAGEMENT: >STATE:1391007297,RECONNECTING,tls-error,,
Wed Jan 29 15:54:57 2014 Restart pause, 5 second(s)
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

SSL VPN - Not working after upgrade to UTM 9

Submitted a Tech Support Case lately from the Support Portal?