Can't import the TLS key for OpenVPN

RouterOS Beginner Basics
1

Hi. I’m a beginner. Please help me set up OpenVPN.
The root of the problem : my router does not see the TLS certificate.
RouterOS Version: 7.16
model = C53UiG+5HPaxD2HPaxD

History:
I tried to set up openvpn using a file.the ovpn that my vpn provider gave me. At first, I tried to import certificates manually by splitting the configuration blocks into 2 files, the first one is , the second one is . The router accepted the first file normally, but refuses to recognize the second one. I also tried to use automatic import via the terminal, but the problem remains the CA certificate is accepted, but tls is not. Which is why I get an error when connecting " vpn-import1727395570: terminating… - TLS error: no key for certificate found (6)"

I smoked all the manuals, played with the extension.key / .pem doesn’t help anything.

Configuration from the provider(.ovpn):

client
auth-user-pass
proto udp
explicit-exit-notify
remote someserver 443
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name **ELIDED** name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
verb 3
route-delay 11
<ca>
-----BEGIN CERTIFICATE-----
**ELIDED**
-----END CERTIFICATE-----
</ca>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
**ELIDED**
-----END OpenVPN Static key V1-----
</tls-auth>
2

Anyone? Does openvpn really work for everyone using tls?

3

Hi,

The tls auth thing is not a certificate.

From:
https://help.mikrotik.com/docs/display/ROS/OpenVPN

OVPN client supports tls authentication. The configuration of tls-auth can be added only by importing .ovpn configuration file. Using tls-auth requires that you generate a shared-secret key, this key should be added to the client configuration file .ovpn.

Also, the following note probably needs to be followed.

Note* ROS client requires user name and password. Authentication is managed by server side, if its supports tls, then user name will be ignored.

Hopefully you can import the .ovpn file (or chop bits out until it will import) and then edit via the gui the resultant config a bit.