From mboxrd@z Thu Jan  1 00:00:00 1970
From: ummeegge <ummeegge@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Testing core update 123
Date: Tue, 28 Aug 2018 21:00:14 +0200
Message-ID: <702c4b152abe934ed04bbf1161f31c85bffdc198.camel@ipfire.org>
In-Reply-To: <002e01d43ef2$2baea2e0$830be8a0$@ministc.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2971208350919000910=="
List-Id: <development.lists.ipfire.org>

--===============2971208350919000910==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi Paul,
an thanks for your feedback. Causing the OpenVPN messages:

Am Dienstag, den 28.08.2018, 18:11 +0100 schrieb Paul Titjen:
> OpenVPN
> Initially had the two crypto warnings so deleted all the cert data
> and then generated new DH parameters with 3076 value.  Then generated
> new certificate data using the 3076 value. This removed the DH size
> warning but still leaves the  following:
> =20
> Cryptographic warning
> Your host certificate is not RFC3280 compliant.
> Please update to the latest IPFire version and generate as soon as
> possible a new root and host certificate.
> All OpenVPN clients needs then to be renewed!
> =20
> =20
> I looked for any settings that I could apply in web GUI to set
> extendkeyusage with TLS Web Server Authentication in the cert
> generation to make the warning go away but could not find a way to do
> this.
The needed changes are already shipped https://git.ipfire.org/?p=3Dipfire-2.x=
.git;a=3Dcommit;h=3Db66b02ab73863bcb9130300d8ef0eecdc51efde3
. To get the needed changes to your certificates and configuration,
 you will need to renew the complete x509 which will also reset all existing =
clients.
You can find in here https://forum.ipfire.org/viewtopic.php?t=3D18852#p108144=
=20
a more detailed discussion about this topic whereby OpenVPN provides some inf=
os also=20
in here https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--ns-ce=
rt-type .

It is time until OpenVPN version 2.5 but ns-cert-type will be dropped then.


> =20
> +       # Warning if certificate is not compliant to RFC3280 TLS
> rules
> +       if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
> +               my $extendkeyusage =3D `/usr/bin/openssl x509 -noout
> -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
> +               if ($extendkeyusage !~ /TLS Web Server
> Authentication/) {
> +                       $cryptowarning =3D "$Lang::tr{'ovpn warning
> rfc3280'}";
> +                       goto CRYPTO_WARNING;
> +               }
> +       }
> +
> +       CRYPTO_WARNING:
> =20
> Is OpenVPN going to require critical extends on the certs in the
> future?
Yes, see above.

> =20
> Hope this somewhat limited testing information helps.
Great, and thanks.

> =20
> Regards,
> Paul
> =20
> =20
> =20

--===============2971208350919000910==--