I already have a working patch for my own setup, I attached it:

Also needs to following new file:

$ cat /opt/vyatta/share/vyatta-cfg/templates/interfaces/openvpn/node.tag/tls/pkcs11-id/node.def
type: txt
help: PKCS11 Identifier

Patch is made for VyOS 1.1.7 (helium)

@dmbaturin can you take a look and merge this patch ?

It would be nice if this was available in the next release. Happy to receive any feedback if I need to improve the patch.

@UnicronNL can you check patch and advise if that is something that we can include in 1.1.8

Is there any progress on this merge?

Now that we can add user-pass authenticaton so the configuration is accepted without cert and keyfile we can fool the configuration to make it accept and work with pkcs11 settings:

# dummy user and pass
set interfaces openvpn vtun1 authentication password 'y'
set interfaces openvpn vtun1 authentication username 'x'

#pkcs11 settings
set interfaces openvpn vtun1 openvpn-option '--pkcs11-providers /usr/lib/libeToken.so'
set interfaces openvpn vtun1 openvpn-option '--pkcs11-id SafeNet,\ Inc./eToken/0123abcd/SafeNet\ eToken\ 5110/10809016BCD13550'

Actually making tls cert-file and tls key-file fully optional would make it more clean, but this is a good workaround.

Hi, I requested this feature, but due to the addition of username/password it can work as a good workaround.

See the solution i posted above.

For what it's worth, you may close this feature request.

The workaround stopped working after the OpenVPN configuration checks moved from Perl to Python. As this still applies to VyOS 1.3 this issue should be reopened, I can also create a new issue if that is preferred.

Old that allowed workaround by enabling username/password authentication as a dummy:
https://github.com/vyos/vyatta-openvpn/blob/current/lib/Vyatta/OpenVPN/Config.pm#L768

New (always requires tls-cert and tls-key):
https://github.com/vyos/vyos-1x/blob/current/src/conf_mode/interfaces-openvpn.py#L331

I still think making the cert-file and key-file directives optional and not mandatory is much better and cleaner. This change would also allow "username/password authentication only" again without any other modifications, next to pkcs11-id directives that someone can add via openvpn-option for advanced use.

Hi @yun,

thanks for your detailed bisection of this issue. You mind submitting a GitHub PullRequest as per https://docs.vyos.io/en/equuleus/contributing/development.html?

PR submitted: https://github.com/vyos/vyos-1x/pull/917

Unfortunately I had to revert this PR as it broke the smoketests and also triggered the following OpenVPN error:

Options error: You must define certificate file (--cert) or PKCS#12 file (--pkcs12)

Hmm. Can you point me to the smoketest that failed? I will investigate. Maybe it actually tests if the strict check are in place, because now cert-file and key-file are optional, but it should keep working if you configure it.

You can find the test here: https://github.com/vyos/vyos-1x/blob/current/smoketest/scripts/cli/test_interfaces_openvpn.py

You can execute it on an installed VyOS ISO by executing: /usr/libexec/vyos/tests/smoke/cli/test_interfaces_openvpn.py

As I suspected, it check if the ConfigSession properly errors if "tls cert-file" and "tls key-file" are NOT defined (for server):

https://github.com/vyos/vyos-1x/blob/current/smoketest/scripts/cli/test_interfaces_openvpn.py#L259

I will refactor my PR without modifying the smoketests

I have made a second attempt of the PR: https://github.com/vyos/vyos-1x/pull/928
The original tls configuration checks are back, but it's only checked if no alternative authentication methods are configured.

Sadly, I could not run the smoketest as it was not present on my VyOS-1.3.0-rc5 iso. Downloading and running the Python smoketest script gave me an error as well.