Search code examples
openvpnsynology

OpenVPN Missing ca.crt in zip file

I am trying to use OpenVPN on my Synology NAS. I configure everything I need and then when I try to export configuration files, the openvpn.zip file that contains only 2 files (README.txt and openvpn.ovpn), the ca.crt file is not included.

Thus, I can't do anything. Would you have any idea about how to correct this unfortunate state?

I have recently updated to DSM 7

VPN Server 1.4.4-2855 after DSM update uninstalled and installed and configured again. Several reboots. Nothing worked for me.

Exported ZIP file contains only Readme.txt and openVPN.opvn.

Thank you for your help!

Solution

  • The zip-File contains 2 files:

    README.txt
VPNConfig.ovpn

    In VPNConfig.ovpn you will find a section like the following which contains the public certificate by which the server-certificate is signed.

    <ca>
-----BEGIN CERTIFICATE-----
....
-----END CERTIFICATE-----
</ca>

    Note: By means of Synology's DSM web front end you only get your server configured to authenticate users by username and password. In order to get client authentication by certificate you have to do the following:

    • Generate the certificates for example using XCA
    • make a copy of /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf and name it /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf.user
    • replace the certificates and keys in /usr/syno/etc/packages/VPNCenter/openvpn/keys
    • edit /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf.user appropiately in order to use these certificates and keys
    • edit VPNConfig.ovpn to contain the intermediate and/or root certificate, the client's certificate and the client's private key

    Here is a tutorial describing the steps in more detail. But unfortunately this is in German, maybe google-translate can help.

    https://blog.diespezialisten.de/2021/04/12/VPN-Server-auf-Synology-mit-User-Cert-und-TLS/