"generate openvpn client-config" does not include the TLS static key in the generated .ovpn file when the server interface uses "tls crypt-key" or "tls auth-key". The resulting client configuration cannot be used as-is to connect to such a server; the key has to be added to the file manually.
Steps to reproduce:
run generate pki ca install ca-ovpn run generate pki certificate sign ca-ovpn install srv-ovpn run generate pki certificate sign ca-ovpn install cli-ovpn run generate pki openvpn shared-secret install ovpn-tls set interfaces openvpn vtun0 mode server set interfaces openvpn vtun0 server subnet 10.255.0.0/24 set interfaces openvpn vtun0 server topology subnet set interfaces openvpn vtun0 tls ca-certificate ca-ovpn set interfaces openvpn vtun0 tls certificate srv-ovpn set interfaces openvpn vtun0 tls crypt-key ovpn-tls commit run generate openvpn client-config interface vtun0 ca ca-ovpn certificate cli-ovpn
The same applies with "tls auth-key ovpn-tls" instead of "tls crypt-key".
Expected behavior:
The generated client configuration contains the static key referenced by the server interface, inline as:
- <tls-crypt>...</tls-crypt> for "tls crypt-key"
- "key-direction 1" plus <tls-auth>...</tls-auth> for "tls auth-key"