Using multi-certificate certificate file with PKI and OpenConnect

[et1000]

Hello,

I’m facing the exact same issue as this post, but with OpenConnect.

Using multi-certificate certificate file with PKI and OpenVPN

Hello, I’m running into a problem regarding certificates for VyOS 1.4. The problem arises when having a CA certificate file with multiple certificates in it that I want to use in my OpenVPN configuration. In VyOS I’m using OpenVPN and in VyOS 1.3 we can supply the CA certificates as a file path (ca.crt, for example), however, in VyOS 1.4 introduced PKI, where you have to import each certificate separately. Now I’m able to import all the certificates/keys, but how am I supposed to use this with…

I use a Let’s Encrypt certificate, with Let’s Encrypt E5 as the intermediate CA and ISRG ROOT X2 as the root CA.
As I can specify only one certificate or ca-certificate, VyOS can’t send a certification chain to my VPN client. This results in a warning message because my certificate cannot be validated, as E5 is not a root certificate.

In other words I’d like to send the fullchain.pem file as certificate.

Or is there an other way to make it work? I use OpenConnect client VPN for Windows which seems to don’t support AIA.
Thanks
Emile

[c-po]

Hi @et1000,

we’ve extended several services with multiple CA certificates already. OpenConnect was yet not improved. Will happen in ⚓ T6500 openconnect: add support for new multi ca-certificate CLI node