2

When trying to use a .ovpn file in Fedora it doesn't load the certificates correctly. It opens the file, but all the certificate spaces are empty and I can't load anything into them. I can manually tear apart the file to create the individual cert files, but that is time consuming and only a cheap workaround. The same file works on my Android devices, so I know the .ovpn file is good. I've seen the same problem in Slackware so it isn't a Fedora-specific problem, but being that I use Fedora I tagged it as such. Anyone know what can be done to fix this?

I can't upload the file but I pasted the text of it here. The IP address and keys are heavily edited so you won't be able to actually use the file for anything, but it can still be loaded as an openvpn configuration if you want to see what it does. Just save the contents as filename.ovpn.

The .ovpn file is generated by the OpenVPN function on my home router.

http://pastebin.com/vAyyPeZg

  • You appear to have disclosed your private key. I hope that was a example CA, certificate & key you generated just to post that, if not you need to immediately revoke the certificate and update your CRLs. – derobert Oct 30 '14 at 15:54
  • I overwrote large chunks of it with random nonsense. It isn't usable for anything. – Kefka Oct 30 '14 at 15:54
  • NetworkManager-openvpn has some support for importing those files but it's by no means perfect. Have you checked that the file works at least when used directly with OpenVPN? – Pavel Šimerda Dec 26 '14 at 23:09
  • I am having the same issue on Fedora 21. I haven't found a fix, but one work-around is to create a VPN connection as root with the command sudo openvpn --config client.ovpn (where client.ovpn is the OpenVPN client profile downloaded from the server). – Steve HHH Apr 29 '15 at 21:48
2

This is a known bug with NetworkManager, and it's been open since October 2010:

It does not seem likely that NetworkManager will be able to import .ovpn files any time soon. Given this, you have two alternatives:

  1. Use the following command instead: sudo openvpn --config client.ovpn. This works for me in Fedora 21.

  2. Break apart the .ovpn file and separate out the keys yourself, then put them in the right fields. I found instructions to do that at https://naveensnayak.wordpress.com/2013/03/04/ubuntu-openvpn-with-ovpn-file/. This works under Fedora 21 as long as you first disable SELinux with the command sudo setenforce 1 or reset the SELinux permissions on the certificates as with mkdir ~/.cert ; mv *.crt ~/.cert ; restorecon -R -v ~/.cert (see this answer on Fedora's Ask server) .

    • Create a file called ca.crt – copy the text between <ca> and </ca> from client.ovpn into this file
    • Create a file called client.crt – copy the text between <cert> and </cert> from client.ovpn into this file
    • Create a file called client.key – copy the text between <key> and </key> from client.ovpn into this file
    • Create a file called ta.key – copy the text between <tls-auth> and </tls-auth> from client.ovpn into this file

In client.ovpn, on the line just before ## —–BEGIN RSA SIGNATURE—–, add the following lines:

ca ca.crt
cert client.crt
key client.key
tls-auth ta.key

After importing the .ovpn file, you'll need to add your username and password, and also need to click on Advanced and go to the TLS Authentication tab. Ensure that Key file is set to ta.key. Key Direction must be set based on the key direction in your client.ovpn file: open client.ovpn and search for key-direction and note the number after that (mine is 1).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.