OpenVPN 2.3.9 no longer prompts for certificate private key password

[sgt_b2002]

After upgrading to OpenVPN 2.3.8 from 2.3.5 attempts to start an OpenVPN connection via systemd do not include a prompt for certificate private key password. Instead, only the username and password prompts appear. Executing OpenVPN outside of systemd via command line works correctly and prompts for username, password, and certificate private key password are provided.

There are no errors that I can see.

Removing --daemon from the unit file results in the prompt for the private key password appearing, but this is not ideal.
Adding --askpass to the unit file does not appear to have any effect.

Upgraded to 2.3.9 and the issue persists.

Additional info:
OpenVPN 2.3.9 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015

Possible Related Tickets:
​https://community.openvpn.net/openvpn/ticket/618
​https://community.openvpn.net/openvpn/ticket/630

Arch Linux Ticket:
​https://bugs.archlinux.org/task/47481

Steps to reproduce:
Launch openvpn via systemd with a private key requiring a password.

[Gert Döring]

Log?

(Without --askpass, it will not ask due to the crypto/daemon change in 2.3.6, but --askpass should do exactly this: ask for the password before daemonizing. It was broken in 2.3.8, but 2.3.9 should be fine)

[sgt_b2002]

Sorry about the logs. I had them prepared but forgot to attach.
However, adding --askpass to /lib/systemd/system/openvpn@.service resolved the issue for me.

The following unit file along with 2.3.9 prompts for the certificate private key password, username, and password in that order. VPN comes up as expected after this.

[Unit]
Description=OpenVPN connection to %i

[Service]
Type=forking
ExecStart=/usr/bin/openvpn --cd /etc/openvpn --config /etc/openvpn/%i.conf --askpass --daemon openvpn@%i --writepid /run/openvpn@%i.pid
PIDFile=/run/openvpn@%i.pid

[Install]
WantedBy=multi-user.target

Adding askpass to the openvpn config resolves this issue as well.

[Gert Döring]

Thanks for confirming that it indeed works with --askpass.

I do wonder why it does not work without - when asking on the console, this is understood ("because there is no more console after --daemon") but if systemd is around, it should still work... could you post a log of that?

thanks

[Gert Döring]

logs?

[Gert Döring]

Throwing over @dazo - I think it's worth trying to reproduce (on a system with systemd which I do not have :-) ), and either close it, or try to fix it... 2.4 and 2.3 might behave differently here, or might not.

[tct]

cc -- Sounds like I can help.

[Gert Döring]

So is this still a thing? @tincantech, have you been able to test with systemd and with/without askpass?