OpenVPN Client Export Bug #756
Description
Describe the bug
When using the Export endpoint it returns "The OpenVPN client export failed for the following reason: Could not find client certificate.".
However the certificate does exist but the code seems to be using the wrong ID.
From my other post:
I did some further debugging and it seems the code from openvpn-client-export.inc (from pfSense itself) is returning the wrong thing.
In this line "$cert = $user['cert'][$crtid];" the $crtid is 30. However the $user array/object returning has the cert with id 30. The certificate itself is ID 30 but inside the $user object/array it has a key value of 0.
When I hardcore the $crtid to 0 it does return the configs.
To Reproduce
Below my example function I do for the call
function testFunction()
{
global $apibaseurl, $apikey;
// CREATE USER CERTIFICATE (pfSense API v1)
$endpoint = $apibaseurl. 'vpn/openvpn/client_export';
$payload = array(
"id" => "0", // OpenVPN server ID
"type" => "confzip",
"certref" => "XXXfa75f76XXX", // VERIFY THIS EXACT ID FROM listCerts()
"username" => "XXX_WarXXetxx",
);
$json = json_encode($payload);
$ch = curl_init($endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $json);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Content-Type: application/json",
'Accept: application/octet-stream', // Critical for binary ZIP response
'x-api-key: ' . $apikey
));
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if (curl_error($ch)) {
echo "cURL Error: " . curl_error($ch);
}
curl_close($ch);
if ($httpCode == 200 && $response !== false) {
// Binary ZIP data - save to file instead of json_decode
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="openvpn_XXX_WarXXetxx.zip"');
header('Content-Length: ' . strlen($response));
echo $response;
//echo "Export successful! ZIP saved as 'openvpn_export.zip' (size: " . strlen($response) . " bytes)\n";
} else {
$data = json_decode($response, true);
$data['http_code'] = $httpCode;
echo "<pre>Error Response:\n";
print_r($data);
echo "</pre>";
}
}
Expected behavior
I expect to get the client export as a ZIP. However I get the error. But when I change the line in openvpn-client-export.inc it does give me back the correct certificate. So the Payload I use in my code does seem to be correct I think.
pfSense Version & Package Version:
- pfSense Version: 2.8.1-RELEASE
- Package Version v2.6.0
Affected Endpoints:
- URL: /api/v2/vpn/openvpn/client_export
If there is more information needed please let me know!