OpenVPN Connect is working only on some Windows machines

[bradm]

I have an OpenVPN server I have setup. I have a few users I'd like to connect to it so I generated them separate .ovpn profiles. As I didn't want a random file granting access to the server have a password included.

I set this up on my macOS, Windows, iOS, and Android systems to make sure the profiles worked everywhere and they all worked perfectly 👍

Getting a fellow dev to follow the same instructions on their Windows machine and they got this error.

pkey :: parse_pem: error in private key :: error : 1c800064 : provider routines :: bad decrypt /error : 11800074 : pkcs12 routines :: pkcs12 cipherfinal error / error : 1c800074 : provider routines :: bad decrypt / error : 11800074 : pkcs12 routines :: pkcs12 cipherfinal error.

(additional spaces were added to the above error as it tried to turn it into emoji soup)

I downloaded their profile and password (via 1Password) to try on my machine and I had no issues connecting from my Windows machine. If they tell OpenVPN Connect to not save their password they can enter it during connecting and it works fine. At some point through a series of deleting passwords, saving blank passwords, etc, it eventually saved and works as intended.

Getting a second dev to connect and they have the exact same problem. No amount of combinations of saving/not saving make it work. Entering password manually works fine. Using it from my Windows machine with their profile + password and I have no issue saving the password.

All 3 of us are using OpenVPN Connect 3.5.1 (3946). There is a slight difference in Windows version, they are a month older. Win 11 23H2 22631.4317 vs 22631.4460.

The error itself is identical to having an incorrect password. Considering the correct password works when opting to not save it, I wonder if it is not saving the password correctly but claiming it is. The passwords have symbols in it, but also the same profile + password combination work on this Windows PC just fine.

When I got this second dev to use OpenVPN GUI (2.6.12), they had no issues saving their password connecting.

My best guess is that I believe there is a bug in the password saving (or loading) part of OpenVPN Connect application which is causing problems for some but not all Windows users.

EDIT:
I asked for the logs. The log in OpenVPN Connect only has

[Nov 13, 2024, 15:37:25] OpenVPN core 3.10.1 win x86_64 64-bit OVPN-DCO built on Oct 14 2024 13:53:17
⏎[Nov 13, 2024, 15:37:25] Frame=512/2112/512 mssfix-ctrl=1250

and that is all

[bradm]

I can't edit the above anymore, so this is some more information of what I found.


I poked around credentials manager (on my working machine) and could find the stored info for OpenVPN Connect. I was curious if I could force save the password outside of OpenVPN Connect to confirm if that was the issue or not. Saving an invalid password in OpenVPN Connect and then setting the correct password in credentials manager did not work. I assume the data saved in credentials manager is not what is loaded into OpenVPN Connect, or it is not in the format of just being a password as text (eg. maybe its json, maybe its also encrypted)

[JosephS]

Hi bradm,

Does your openvpn profile require to have an EPKI (.p12 cert) imported in to the connect app in order to establish connection?
It's interesting that this error only shows up on some Windows machines but not on others.


Can you check if this issue is reproducible on a somewhat older Connect App version (3.4.4)?:

https://swupdate.openvpn.net/downloads/connect/openvpn-connect-3.4.4.3412_signed.msi

With Regards,
JosephS