Page MenuHomeVyOS Platform
Create Task
Maniphest T8280

Update from 1.3.8 to 1.5: Image-based upgrade OpenVPN migration issue
Closed, ResolvedPublicBUG
Actions

Description

The update itself completes successfully, but there is an issue with OpenVPN certificate migration.
To describe the problem clearly, the configuration can be divided into three parts:

  • Base configuration (interfaces, system, basic services)
  • OpenVPN interface configuration
  • OpenVPN certificates

Observed behavior
During Image-based upgrade

Base configuration is migrated correctly - OK
OpenVPN interface configuration is missing
OpenVPN certificates are missing

When attempting to reproduce the migration using load (manual load):

vyos@vyos# load
Load complete. Use 'commit' to make changes effective.
[edit]
vyos@vyos# compare 
[interfaces]
+ openvpn vtun1 {
+     local-address 10.255.1.1 {
+     }
+     local-port "1195"
+     mode "site-to-site"
+     persistent-tunnel
+     protocol "udp"
+     remote-address "10.255.1.2"
+     remote-host "203.0.113.11"
+     remote-port "1195"
+     tls {
+         role "active"
+     }
+ }
+ openvpn vtun2 {
+     local-address 10.255.2.1 {
+     }
+     local-port "1196"
+     mode "site-to-site"
+     persistent-tunnel
+     protocol "udp"
+     remote-address "10.255.2.2"
+     remote-host "203.0.113.12"
+     remote-port "1196"
+     tls {
+         role "active"
+     }
+ }

OpenVPN interface configuration is added - OK
OpenVPN certificates are still missing, which leads to next error:

vyos@vyos# commit
[ interfaces openvpn vtun1 ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 146, in run_script
    script.verify(c)
  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 607, in verify
    verify_pki(openvpn)
  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 178, in verify_pki
    pki = openvpn['pki']
          ~~~~~~~^^^^^^^
KeyError: 'pki'

[[interfaces openvpn vtun1]] failed
[ interfaces openvpn vtun2 ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 146, in run_script
    script.verify(c)
  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 607, in verify
    verify_pki(openvpn)
  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 178, in verify_pki
    pki = openvpn['pki']
          ~~~~~~~^^^^^^^
KeyError: 'pki'

[[interfaces openvpn vtun2]] failed
Commit failed
[edit]

When loading the pre-migration configuration directly:
Loading the pre-migration.config file works correctly

vyos@vyos# load /config/config.boot.20260217-143249.pre-migration

The configuration is applied without errors

vyos@vyos# compare 
[interfaces]
+ openvpn vtun1 {
+     local-address 10.255.1.1 {
+     }
+     local-port "1195"
+     mode "site-to-site"
+     persistent-tunnel
+     protocol "udp"
+     remote-address "10.255.1.2"
+     remote-host "203.0.113.11"
+     remote-port "1195"
+     tls {
+         ca-certificate "openvpn_vtun1_1"
+         certificate "openvpn_vtun1"
+         role "active"
+     }
+ }
+ openvpn vtun2 {
+     local-address 10.255.2.1 {
+     }
+     local-port "1196"
+     mode "site-to-site"
+     persistent-tunnel
+     protocol "udp"
+     remote-address "10.255.2.2"
+     remote-host "203.0.113.12"
+     remote-port "1196"
+     tls {
+         ca-certificate "openvpn_vtun1_1"
+         certificate "openvpn_vtun1"
+         role "active"
+     }
+ }
[]
+ pki {
+     ca openvpn_vtun1_1 {
+         certificate "MIIDwzCCAqugAwIBAgIUSAvGMqYdlxyZpim08pqPs0p4ecEwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yNjAyMTYxMjIwNTVaFw0zMTAyMTUxMjIwNTVaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCIKSU32wJPPO9BJ8tvyvCgGsT9HiD/VC18Tui1FxCOQAw/woCtfvSER+CycFVEm0zwm9xcMSdlhT1Qo1x9kqKXGwgkbTiazDngnqiosTdU5l/c0pZvBH1OZixHC1FPJkTd/BwGQR2bpZwtAPdPPqh8nD4Vo+FspmPyVC+nYmCApwED4VgprwhhpPOoshs8OCsFwGEFRM4f1dvNV0mRlzYhd9d23W0B8/wHfEKvE++9RG/WmPi3M+GQF5VOeh31Tpv2gev0+4kNgr7eUdJRRUhdQXIEbsMUI8+XwIawtAyj8HdLjCw/zuCwo8lXTf96bjuDaZ4TVhlEOASgfUsffD5zAgMBAAGjgYYwgYMwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB0GA1UdDgQWBBSH0pbozB9Ken79b5qVIk2WibhMkzAfBgNVHSMEGDAWgBQ21oyLO+d9XIFY4dCC3BHgJdelYDANBgkqhkiG9w0BAQsFAAOCAQEAu2Z8OoBVKkwYMuXI/VUIRKyCdc36a+KGCE9V8IMCdTH0gjfSpPlBbbbPr9NQxj6JP3qTab6ozXXzF8TBmx3/jYqvraOOV4hXxnqXO30M3ScFwcG59gRbD44LhljwoKVm3YJ8hLjS825DGbTSDc8M/6Sev80MbTgw2sCxam404q8u00fNeIIpDa6cxU0YbPh6nJ4t7wsKz65rWq5qyagcAMf6lh5oPFlM6w9wQP0GKnFi2pgBHUjuy1qLQ0t3uBItSOQQkxJFU/uKq8DhfOgMmiGwGyqH7Ek4w1SqD6kMdDyvydIWALz+yW5H1lBQlzxlW2PVF+JqAFmbfMYsJvZLPQ=="
+     }
+     certificate openvpn_vtun1 {
+         certificate "MIIDsTCCApmgAwIBAgIUJJ1VQ7ZucgvsWG05D7EHu0M6fwYwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yNjAyMTYxMjIxNTdaFw0yNzAyMTYxMjIxNTdaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgKzvMKIZg16Zm/3PK8UwHbo75z6IvMhV3og8ATxfmewUu/IdOAnipcQtm8+GoJmRNKHHpbfDjK5BBs5kwnifIuIY/ulRyPCpkJvzfozpe/HF8/S7E/fHfZmDTlCR7T+I4u6AaS1KO97HyyQf3ZpTXjKrCk03aYuARm8MTW+5HZT9y7/rFiGrbJiGv5xQpWnRhwT7kygJMg3PZqD8vuSIhDVkm1JcJpfsK1Xh6baqgUI3WnrgJRajwcF6Fc1UyYV4vA2gWe2nYcw0eKJo37Fo5RpZM4tu3QQpoqlhbYFbjS+knAPQeyaHHhxObq/eXb4ruL6BR11MnsA6HQ0bEImYDAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBR/k2lXHuKGzGATLnxZw+h7BOFzTDAfBgNVHSMEGDAWgBSH0pbozB9Ken79b5qVIk2WibhMkzANBgkqhkiG9w0BAQsFAAOCAQEAceddrz/mtyByPGZDqCxfpe8NE0Z/zeCLeEugqXEI4m88uZTRipxe5fvAGj5GoEXW9YaVPwDdJ9D9zskfZLaQDkIb/ds4kZtgJFU1bQx7Q8rtXqvrWSApsU8PiLSd7+vIadAhFSESRq6t4ajPkRR5Lnijq/Bl/J2T5YzE1PwhgTUXfA6ozDnO8fQz0f2LdGGPKbZOKFmZaKpqDWlY2exK/0lNX/IifvD8KdSTkJ3Bu8NfEBi6Om91JZO0h43QpdMuhQXAQxz93UmMeZD895ci5JlPbY4dypURVqIo0Ql2etEFobklBKd7gDSZ2QB7w5dinbmjXNlmWNfITevhNu/P9Q=="
+         private {
+             key "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCgKzvMKIZg16Zm/3PK8UwHbo75z6IvMhV3og8ATxfmewUu/IdOAnipcQtm8+GoJmRNKHHpbfDjK5BBs5kwnifIuIY/ulRyPCpkJvzfozpe/HF8/S7E/fHfZmDTlCR7T+I4u6AaS1KO97HyyQf3ZpTXjKrCk03aYuARm8MTW+5HZT9y7/rFiGrbJiGv5xQpWnRhwT7kygJMg3PZqD8vuSIhDVkm1JcJpfsK1Xh6baqgUI3WnrgJRajwcF6Fc1UyYV4vA2gWe2nYcw0eKJo37Fo5RpZM4tu3QQpoqlhbYFbjS+knAPQeyaHHhxObq/eXb4ruL6BR11MnsA6HQ0bEImYDAgMBAAECggEAA12FLx/22tgNHgLmCvCQ+WMATA1pyfYSb2YPTKFczjHthPQ3X5M7t8uxQqODLUZJOznLUu1Fb3B94nOEl3nrOhNudq5SkefjuCD9lTFXy6EgPVEQh4EScPA0vp1ROuoNxcVjcsn8XRalPYWtzivwmqrQ96+ipiEHtjcAnUqEMinM7hmmgHqr/SXCJcW+i1cV4KYcCvY7ACu0Z/giMdpgV927M2XgMilybzPlRMAX7X3DS76K19F6cjg5hIukRTG392vR5e36rK4+YdKoirhnm2/0Xs7MgTHc+ns0ZCNaeJ44evK2rdm1UDBlFOF/vwQrOOPf4jJXzEFnKz66IDnRsQKBgQDLDuEcdwmThbuy/6XE0+rp2vTl++0mA90GyzXmGb+gxFccOY/yKOcts0Y2UuvPC9T8KBCyREJSj8rIP73Mi0ZnttJgB9MbuireFBNH1mtpvP6EJ9eorBe6Q1VwJuajBc4TOzE5D2n4IQsGbrnlMYU4SaIqBKswtBzKEWicY5TlOQKBgQDJ7bXkC7iSlHyYyqy1Mo2eSFWbc9+n99VatjltuXhyQhzZQRmWjkRcjxX04YmKOl+JOLeOuCAawZFfGW68Xdu5F75DyAiuTDegPz8VhHcGc8+i0/R1yXddGHhBAcTiKZYr93ziLrh/d7BtnMGeSyjuPVqQgHEb1VPK8JM049EBGwKBgEAL5mbzCNs2ADj6N4/4g4zVWg88QdWOvGVLLSnxjyanJw6o/UUVL62TcR7rUqNQiRIrlPCVZRHjdsNoj3X3q/JEkOBnN2f0dVbsoBQ1hlWoneKTKotyFF3UpRslufNLfm9EaUclHHh9+5tAy3OGBg3186crJ8/Jz5bQnN1O74TJAoGAd7SOpoD4SxTxhBZqKgStBY82CLC5frah6WOrScuwhnOA7J32EFWIWyKLzp7BTYtrRUq1Lksi5RmpFypZhhtR/TkBFueHleQi+cFkoVnkwZN4HLvv6L+lHjA6YbctwzEKEEhn5SHzR8VpdqF9+lvuCMWgYZdy9iARy3WwnqMLLM8CgYBUOtXVNkMCjIxJ4tmRdYngBkuBY5g9axzTgSEuHX0FN0rV/tId2WLRC5Vu7DuRsjsH5vXVhciKK4NT9wyo1D0eGuQCzLlOuig+oaVG1jNQhqIgjW1vusG3E97ZOGab6ShFWW5FcdXFn8cggAp6LphqRJ+KMMRIixpAl9GDALHaQg=="
+         }
+     }
+ }

Additional notes:
Certificate files remain present in their original directories

vyos@vyos:~$ ls -l /config/auth/
total 12
-rw------- 1 root vyattacfg 1367 Feb 17 14:04 ca.crt
-rw------- 1 root vyattacfg 1342 Feb 17 14:04 server.crt
-rw------- 1 root vyattacfg 1705 Feb 17 14:05 server.key
vyos@vyos:~$

Config:

config.boot2 KBDownload

Log:
first_boot.log97 KBDownload

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Related Objects

Event Timeline

a.pidnebesny created this task.Feb 17 2026, 2:40 PM
a.pidnebesny created this object in space S1 VyOS Public.
Viacheslav raised the priority of this task from Low to High.Feb 17 2026, 2:45 PM
Viacheslav changed the subtype of this task from "Task" to "Bug".
pasik subscribed.Feb 17 2026, 3:28 PM
c-po assigned this task to jestabro.EditedFeb 26 2026, 8:33 PM
c-po subscribed.

Regression added via https://github.com/vyos/vyos-1x/pull/2353/changes

Migrating from

set interfaces openvpn vtun0 mode 'site-to-site'
set interfaces openvpn vtun0 local-address '192.0.2.60'
set interfaces openvpn vtun0 remote-address '192.0.2.61'
set interfaces openvpn vtun0 shared-secret-key 'ovpn_test'
set interfaces openvpn vtun0 encryption cipher 'bf256'

Result in config causing restart loop:

set interfaces openvpn vtun0 local-address 192.0.2.60
set interfaces openvpn vtun0 mode 'site-to-site'
set interfaces openvpn vtun0 remote-address '192.0.2.61'
set interfaces openvpn vtun0 shared-secret-key 'ovpn_test'

As there is no matching data-ciphers-fallback for bf256

c-po added a project: VyOS Rolling.Feb 26 2026, 8:33 PM
o.kuchmystyi claimed this task.Apr 21 2026, 2:32 PM
o.kuchmystyi added a subscriber: jestabro.
o.kuchmystyi changed the task status from Open to In progress.Apr 21 2026, 2:39 PM
o.kuchmystyi added a comment.Apr 27 2026, 2:26 PM

PR: https://github.com/vyos/vyos-1x/pull/5152

o.kuchmystyi mentioned this in rVYOSONEX996a872eca87: migration: T8280: Fix auth file read for interfaces on first boot of new image.Apr 30 2026, 3:06 PM
Restricted Repository Identity mentioned this in rVYOSONEX5c4afee8c5bf: Merge pull request #5152 from alexandr-san4ez/T8280-current.Apr 30 2026, 3:06 PM
o.kuchmystyi closed this task as Resolved.May 1 2026, 9:24 AM