Cert export (.p12) corrupted

[schafskopf]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [ ✔] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ ✔] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

The certificates issued by a CA on the OPNsense can no longer be exported in .p12 format. The files are corrupt after the download and cannot be opened or imported.
This was definitely functioning with version 23.7

To Reproduce

Steps to reproduce the behavior:

1. Go to System: Trust: Certificates
2. Click on "export ca+user cert + user key" on a self signed cert
3. Try open or import the .p12 File
4. File is corrupted

Expected behavior

A working .p12 File that i can use.

Describe alternatives you considered

export user cert and key file separately

Environment

OPNsense 24.1.1 (amd64).
DEC840

[AdSchellevis]

not likely corrupted, format has changed due to openssl changing to version 3 (RC2-40-CBC being deprecated).

openssl -version

openssl pkcs12 -in my_cert.p12 -info

[schafskopf]

You're right, it was in the release notes - I hadn't thought about it.
I'm not really a specialist when it comes to certificates, but somehow I can't manage to create a certificate that works to get access to the wifi. Before the update it was no problem.

I have now tried to convert the certificate into a .pem file. But this does not work either.

I see that the problem is not on the OPNsense side, so you can close the issue. I have to do my research.
Nevertheless, if you can give me a hint I am of course very thankful.

[AdSchellevis]

I'm not 100% sure, but expect something like:

openssl pkcs12 -export -legacy -in cert.pem -inkey key.pem -out bundle.p12

[schafskopf]

Thank you, this looked very promising. I now had a .p12 file that could also be opened via the GUI. However, the Wlan authentication still does not work. Maybe it is also related to Linux Mint. Previously I only had Fedora, popOS and Android clients. So it could also be related to Linux Mint. I will try again on another client when I get the chance.

I always have the following errors in the FreeRADIUS log:

• ERROR: (549) eap_tls: ERROR: (TLS) Alert read:fatal:bad certificate
• Auth: (549) Login incorrect (eap_tls: (TLS) Alert read:fatal:bad certificate): [/] (from client AP_ port 0 cli C8-F7----)

[schafskopf]

Ok, it looks like it's a Linux Mint problem. I have no problems on another Linux OS with the same certificate. also without converting the certificate - so directly the .p12 file from the OPNsense.

Many thanks for your help.