*** This bug has been marked as a duplicate of bug 1432152 ***

Sorry!  This is a different issue (PKCS#12) than bug #1432152 (PKCS#11).

But my gut feeling is that it is related to the move from using OpenSSL to mbed TLS.  It might be the Fedora mbed TLS builds is also lacking PKCS#12 support.

Workaround - extract certs and keys from the pkcs#12 file.

$ openssl pkcs12 -in $PKCS12FILE -nokeys -cacerts > openvpn-ca.crt
$ openssl pkcs12 -in $PKCS12FILE -nokeys -clcerts > openvpn-cert.crt
$ openssl pkcs12 -in $PKCS12FILE -nocerts -nodes > openvpn-private.key

If you skip '-nodes' in the last line private key file will be password encrypted.

I will look into the mbed TLS packaging and see what is needed to change to resolve this issue.

Btw ... can you also please provide a configuration file?

Created attachment 1270548 [details]
openvpn configuration file

Created attachment 1270549 [details]
configuration file for Network Manager

Hello, David.
Thank you for attention to my request. Find in attachment openvpn configuration file and the file, which was used by Network Manager to create this connection (openvpn configuration file)
Best regards, Alexandre.

See the openconnect test suite for a set of certificate files you should probably be testing with...

I'm quite surprised.  When starting to test your configuration, it seems to "work" (pass and start connecting to a server of mine) when compiled with OpenSSL. When doing the same test with mbed TLS, it is a very different story.

The quick answer is: The current state is that the mbed TLS implementation in OpenVPN does _not_ support --pkcs12.  This is something I was not aware of.  When looking at the mbed TLS API, it seems to be quite a bit more work to implement the missing pieces for PKCS#12 support.

Tomorrow I will get in touch with some guys knowing the mbed TLS implementation far better.  Perhaps we can put down a plan to resolve this.  But I can not make any promises now.

The short version of why we've switched to mbed TLS in F26 is that F26 want to ship with openssl-1.1.  OpenVPN is not prepared for that yet (Only ~50% if the contributed patches to make this work is reviewed and applied to the upstream OpenVPN tree)  So in the mean time it was decided to ship an OpenVPN built against mbed TLS instead - knowing it was not 100% feature compatible with the OpenSSL builds.  But it would be better with a reduced OpenVPN than no OpenVPN.  

Once OpenVPN can build against OpenSSL 1.1, I will switch back.  But right now, that isn't an option.

I have checked this more carefully now.  The mbed TLS library completely lacks support for PKCS#12 files.  Which makes it impossible to make use of those files as it is today.  There are some partial PKCS#12 support, but that only covers password encryption used in PKCS#8 private keys and not the PKCS#12 file container.  So I am sorry to say that the mbed TLS library and PKCS#12 files is currently a dead-end.

On the other hand, I have recently discovered the compat-openssl10.  But that breaks PKCS#11 support, as there are package conflicts between openssl-devel and compat-openssl10-devel when installing the needed pkcs11-helper-devel package.

So currently, I have the options of:  a)  Keep mbed TLS builds and break PKCS#12, or b) Switch to compat-openssl10 and break PKCS#11 smart card support.

To be honest ... I have no idea which path is the least painful for most of the users.  Had I known that, I'd do a decision right now.

I have reached out to Tomas Mraz (openssl/compat-openssl10 maintainer) and Kalev Lember (pkcs11-helper maintainer) to see if we can find a way to avoid the pkcs11-helper situation.  If that is doable, I will soon switch back to OpenSSL again.

Using compat-openssl10 is not possible for OpenVPN, as it depends on pkcs11-helper also being built against compat-openssl10.

I have asked for confirmation if the mbed TLS builds with PKCS#11 support is working.  If it is, I will prefer PKCS#11 support over PKCS#12.  The reason for that is that PKCS#11 have a workaround (you can split that file up into CA, Certificate and Private Key files using the "openssl pkcs12" command).

If however PKCS#11 support is _not_ functional with mbed TLS, I will switch to build OpenVPN against compat-openssl10 without PKCS#11 support.  Which re-enables PKCS#12 support.

openvpn-2.4.2-1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-89d98779ec

openvpn-2.4.2-1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-89d98779ec

Work well for me now

openvpn-2.4.2-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.