On 2025/01/03 10:59, Klemens Nanni wrote: > 03.01.2025 09:32, Bjorn Ketelaars пишет: > > With your diff, pkcs11-helper builds without support for mbedtls. Have a > > look at the output of configure. BTW, 'make test' fails all tests. > > > > I think you also need to pass MBEDTLS_CFLAGS and MBEDTLS_LIBS. With this > > mbedtls is picked up, pkcs11-helper compiles, and passes all tests. > > Could you recheck with the diff below? > > Ah, I forgot to pass MBEDTLS_*, thanks. > > Still no luck, it doesn't even make it to the PIN1 prompt: > > $ doas openvpn ./config.ovpn > ... > 2025-01-03 13:54:03 OpenVPN 2.6.12 x86_64-unknown-openbsd7.6 [SSL (mbed TLS)] > [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] > 2025-01-03 13:54:03 library versions: mbed TLS 2.28.0, LZO 2.10 > 2025-01-03 13:54:03 PKCS#11: Adding PKCS#11 provider > '/usr/local/lib/p11-kit-proxy.so' > 2025-01-03 13:54:04 ERROR: external key with mbed TLS requires a certificate > with an RSA key. > 2025-01-03 13:54:04 PKCS#11: Cannot register signing function
I wonder if LD_DEBUG will give any clues as to what's happening here. > 2025-01-03 13:54:04 Cannot load certificate "..." using PKCS#11 interface > 2025-01-03 13:54:04 Error: private key password verification failed > 2025-01-03 13:54:04 Exiting due to fatal error > $ pkg_info -m | egrep 'vpn|pkcs' > openvpn-2.6.12p1-mbedtls easy-to-use, robust, and highly configurable VPN > pkcs11-helper-1.30.0p1 library with PKCS#11 providers for end-user > applications > $ ldd `which openvpn` > /usr/local/sbin/openvpn: > Start End Type Open Ref GrpRef Name > 0000096b1fa76000 0000096b1fb4d000 exe 2 0 0 > /usr/local/sbin/openvpn > 0000096d5258a000 0000096d525ba000 rlib 0 1 0 > /usr/local/lib/liblzo2.so.1.0 > 0000096d69388000 0000096d693bf000 rlib 0 1 0 > /usr/local/lib/liblz4.so.3.3 > 0000096dac816000 0000096dac84c000 rlib 0 2 0 > /usr/local/lib/libmbedtls.so.7.0 > 0000096dd3a92000 0000096dd3a9f000 rlib 0 5 0 > /usr/lib/libpthread.so.27.1 > 0000096d89899000 0000096d898bc000 rlib 0 3 0 > /usr/local/lib/libmbedx509.so.3.2 > 0000096e18e1f000 0000096e18ea9000 rlib 0 4 0 > /usr/local/lib/libmbedcrypto.so.5.0 > 0000096dda918000 0000096dda931000 rlib 0 1 0 > /usr/local/lib/libpkcs11-helper.so.0.0 > 0000096e0ac66000 0000096e0ad6d000 rlib 0 1 0 > /usr/lib/libc.so.100.3 > 0000096e041c4000 0000096e041c4000 ld.so 0 1 0 > /usr/libexec/ld.so > > > If at all, pkcs11-helper should have FLAVOR=mbedtls, of course. >
