Good afternoon. At me the following problem - openvpn does not work on devices with operating system IOS. In doing so, everything works on other operating systems including (MacOS). In this case, this situation is observed only if the certificates were generated in Mikrotik. If you import keys created into linux into it, everything works fine. First he gave such a mistake.
2017-06-25 01:43:04 EVENT: CORE_ERROR PolarSSL: error parsing config private key : PKCS5 - Requested encryption or digest alg not available [ERR]
How I figured this out was because the microphone encrypts the private key with a format that does not support iOS.
After my manipulations, the algorithms coincided. But there was another mistake.
2017-06-25 23:01:56 Client exception in transport_recv_excode: PolarSSL: SSL read error : SSL - Processing of the Certificate handshake message failed
I ask to help with the decision of the given problem.
Openvpn on ios can work too. But only with the certificates that were generated using the utility easyrsa. Staff means mikrotik do not get it. But if you import third-party certificates then certificate revocation does not work. Can anyone tell me with which keys to generate a certificate on the router that it would be compatible with the IPhone.
I tried to find solution for the same problem Mikrotik OpenVPN with iPhone.
I can’t find out how to fix problem - PKCS5 - Requested encryption or digest alg not available [ERR]
I found only one post on MikroTik forum.
I’m trying to connect to the vpn from my iPhone, but I still can’t get working solution for this.
Same time I’m using same OpenVpn from my MacOS without any problems.
From OpenVpn iPhone app I’m getting following messages :
2018-04-04 22:04:33 ----- OpenVPN Start -----
OpenVPN core 3.2 ios arm64 64-bit built on Feb 22 2018 12:39:28
2018-04-04 22:04:33 Frame=512/2048/512 mssfix-ctrl=1250
2018-04-04 22:04:33 EVENT: CORE_ERROR mbed TLS: error parsing config private key : PKCS5 - Requested encryption or digest alg not available [ERR]
2018-04-04 22:04:33 Raw stats on disconnect:
2018-04-04 22:04:33 Performance stats on disconnect:
CPU usage (microseconds): 24407
Network bytes per CPU second: 0
Tunnel bytes per CPU second: 0
Maybe somebody is using Mikrotik OpenVpn with iPhone sucessfully or can help me to find solution ?
I see the same on my Android device.
Connecting to my Mikrotik hAP ac2 does not work any more (firmware 6.43.2) from my Samsung Galaxy S6 phone (Android 7.0, using the official ‘OpenVPN Connect - Fast & Safe SSL VPN Client’ from the Google Store). Connecting from a Windows10 computer works fine.
No error messages, just a lot of ‘TCP connection established’ messages in the Mikrotik logfile.
It did work in the past (about a month ago, so before the update to 6.43.x)
Modification 2018-10-22:
I found another Android OpenVPN app, which gave me much more, and much more detailed, errorlogging (“OpenVPN Client Free”). Using this app I could pinpoint a certificate error. Now I can connect using both Windows 10 and Android 7.0.
So looking back it was not a MikroTik software problem, although the absence of detailed error logging on the MikroTik hAP ac2 made solving this problem rather complex.
And after a whole afternoon of battling it would appear that I accidentally disabled the secret on the Mikrotik which was the cause of my connection resets.
OpenVPN now working. Steps taken:
Export client certificate as PKCS on Mikrotik, CA certificate as PEM.
Create .ovpn file with CA cert embedded inline - example of mine below
dev tun
proto tcp-client
remote my.domain.com
port 1194
nobind
persist-key
persist-tun
tls-client
remote-cert-tls server
verb 4
mute 10
cipher AES-256-CBC
auth SHA1
ping 15
ping-restart 45
ping-timer-rem
auth-user-pass auth.cfg
auth-nocache
<ca>
-----BEGIN CERTIFICATE-----
[your CA cert here]
-----END CERTIFICATE-----
</ca>
pkcs12 cert_export_client1.ovpn12
Import .p12 certificate via Mail app into iPhone Keychain (as per iOS article posted above - though I don’t feel this is necessary as even without this step the VPN works)
Copy the .p12 to a .ovpn12 file as per the article again.
Import certs (.ovpn12), auth.cfg and ovpn file in iTunes for OpenVPN
Import certificate in OpenVPN app
Import profile in OpenVPN app and assign certificate (ovpn12)
BES2