ipfire/ipfire-2.x — pull request #25 by ferstl (2014-05-11 12:10:20+00:00)
Title: OpenVPN: Fix tls-verify with email address in X509 identifier

OpenVPN’s TLS verification will fail when the client’s certificate contains an “emailAddress” attribute.
The reason is that when a client certificate is uploaded to IPFire the resulting entry in `/var/ipfire/ovpn/ovpnconfig` will contain the CN and the emailAddress separated by a slash character as certificate name.
The script used for tls-verify, however, treats everything after the `CN=` string in the X509 identifier as certificate name. So if the client’s certificate happens to contain an email address the certificate name that the TLS verification script expects will never match the entries in ovpnconfig.

**Example**
The certificate with the identification `C=XX, L=Xxxxxx, O=xxx, OU=XX, CN=ovpnClient, emailAddress=ovpnClient@example.com` will generate this name in ovpnconfig when uploaded: `ovpnClient/emailAddress=ovpnClient@example.com`. On the other hand, the TLS verification script expects the certificate name `ovpnClient, emailAddress=ovpnClient@example.com` (there’s a comma and a space and not a slash) to be in ovpnconfig when the client tries to connect. The expected name will never match the entries in ovpnconfig which results in an error during the TLS handshake:

WARNING: Failed running command (--tls-verify script): external program exited with error status: 1
VERIFY SCRIPT ERROR: depth=0, C=XX, L=Xxxxxx, O=xxx, OU=XX, CN=ovpnClient, emailAddress=ovpnClient@example.com
TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

To fix this issue, all commas in the expected certificate name need to be replaced by a slash character in order to get the certificate name in line with the entries in ovpnconfig.