Hi,
We have an issue with some new SSL certificates that we have got, if we use our own self created certs the SSTP VPN connection works,
However we have a requirement to change/update the certs, I have the ca.crt, the server.crt and the appropriate key file, which I have validated using SSL tools and they all match and pass successfully.
However when we use them on the VyOS firewall, we get the below error in windows 10 on connecting: The token supplied to the function is invalid
The only log file entry that happens at the time is below:
Jul 25 09:53:44 vyos accel-sstp: sstp: started
Any ideas, I have checked through other topics with similar issues and the fixes haven’t resolved it for me?
Mark
Dmitry
July 25, 2020, 2:57pm
2
Hello @MarkSpringate , did you try to open your host via Internet Explorer?
Hi @Dmitry
Many thanks for the reply
I internet explorer I get the following:
This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.
In firefox I see the below (posting it as the message is different in case it helps):
An error occurred during a connection to 192.168.71.100. PR_END_OF_FILE_ERROR
I am not sure how to check what TLS version is being used, but I am using the latest rolling version of VyOS: VyOS 1.3-rolling-202007240117
Dmitry
July 25, 2020, 3:08pm
4
I think you can check ciphers and version by the following commands
openssl x509 -text -noout -in /config/auth/sstp/ca.crt
openssl x509 -text -noout -in /config/auth/sstp/server.crt
Or you can check with some online checker.
The top of the output on there shows the below for both the ca and server.crt files:
The only other version field or anything related to TLS is below:
Dmitry
July 26, 2020, 5:31pm
6
Hello @MarkSpringate , can you run following commands and provide output
accel-cmd -p 2005 restart
show log tail 50
If it possible provide, provide please also sstp configuration commands
show configuration commands | match sstp
Hi @Dmitry
thanks for the reply again, please find output below:
vyos@vyos:/var/log$ show log tail 50[email protected] : Succeeded.[email protected] : Service RestartSec=100ms expired, scheduling restart.[email protected] : Scheduled restart job, restart counter is at 1.
set vpn sstp authentication local-users username csadmin password ‘password’
Dmitry
July 27, 2020, 9:13am
8
Hello @MarkSpringate , please fix this error
Jul 27 06:39:05 vyos accel-sstp: sstp: ssl-keyfile error: error:0909006C:PEM routines:get_name:no start line
You have got issue with ssl-keyfile
Note: please don’t post your public IPs, your latest message redacted by me.
Dmitry:
0909006C
Hi @Dmitry
I clearly missed one of the IP addresses! thanks for that
The key file itself passes the ssl checker tools that we have tried, is there any pointer as to what is wrong with the file?
Mark
Dmitry
July 27, 2020, 9:46am
10
@MarkSpringate , show please sudo head -n 1 /config/auth/sstp/server.key
vyos@RTR1:~$ sudo head -n 1 /config/auth/sstp/server.key
-----BEGIN PRIVATE KEY-----
vyos@vyos:/config/auth/sstp$ sudo head -n 1 /config/auth/sstp/server.key
Dmitry
July 27, 2020, 10:00am
12
Hm, that is very odd, I don’t know how to reproduce this issue without certificates. Check please also end of file
Hi @Dmitry
I think I may have got a step further and am testing it tomorrow morning. It looks like the content of the key file is OK but the file encoding may have been the issue, the .key file was set to UTF-8-BOM which I have now changed to UTF-8, on my test VyOS firewall I no longer get the above errors but due to the certs being registered against a specific CA I need to test it in the morning to make sure my username/password auth works correctly on the live firewall
Mark
Hi @Dmitry
Well one step forward I feel! I am no longer getting the token error, but when I try to connect it now gives me the below:
Which is a little odd considering the SSL certs as well as the key file are now passing all checks
Mark
Dmitry
July 28, 2020, 7:20am
15
Hello @MarkSpringate , check please again with Internet Explorer.
Hi @Dmitry
Fixed it, it is exactly what you thought, I had the IP address in the config details rather than the DNS name which was used for the cert!
For info, the fix for the error “The token supplied to the function is invalid” was to open the .key file in notepad++ and click Encoding > and change it to UTF-8 to match the .cert files, originally it was in UTF-8-BOM format
I need to test it again on the live firewall tomorrow, but it is now working perfectly on the test one
Mark
system
July 30, 2020, 7:56am
17
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.