OpenVPN Connect does not attempt to connect when using static challenge

[dwilliams15]

I have an OpenVPN setup that was working fine, using OpenVPN Connect as the client app. It's using LDAP for username/pass auth with no client cert. I'm now working on adding MFA, however when I add the static challenge line to my ovpn file, I stop getting any connection attempts made.

The prompt shows up, I put in my MFA token, and then the prompt disappears and....nothing happens. No auth failure, no attempt to connect, and absolutely no entries in the log files. On the server side I don't see any packets coming in, or any sort of auth attempt so it appears that the app is not sending out anything at all.

Has anyone seen this before?

My ovpn file is as follows (with server IP and ca removed):

client
dev tun
proto udp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verb 3
mute 20
auth-user-pass
static-challenge "MFA Code" 1
<ca>
-----BEGIN CERTIFICATE-----
**
-----END CERTIFICATE-----
</ca>

[dwilliams15]

As a follow-up, this configuration works fine in Viscocity (an alternate, paid client which I downloaded a trial of) and connects as expected. There is something wrong with the OpenVPN Connect App with this combination of options

[JosephS]

Hi dwilliams15,

This is know case with the latest connect app and profiles that require an external EPKI to connect on top of static-challenge MFA.

If you press on the "Edit profile" icon and if you see that it contains a "Certificate and Key" section that means your profile also requires an .p12 certificate for connection. (see attached image)

In order to resolve your issue , I would suggest:

1. Import the .p12 certificate via the connect app and assign it your profile.
2. Generate a new connection profile that does not require a .p12 certificate for connection.

Hope this helps.
Regards,
JosephS