Where can I read more information about this error:
The journal entries are not helping
journalctl -f
**Jun 06 11:40:05 ws-study nm-openvpn[44329]: OpenSSL: error:8000000D:system library::Permission denied:calling fopen(/home/j/Documents/Keys and backups/Watchguard/client.crt, rb)
Jun 06 11:40:05 ws-study nm-openvpn[44329]: OpenSSL: error:10080002:BIO routines::system lib:
Jun 06 11:40:05 ws-study nm-openvpn[44329]: Cannot load certificate from URI </home/j/Documents/Keys and backups/Watchguard/client.crt>
Jun 06 11:40:05 ws-study nm-openvpn[44329]: Exiting due to fatal error
Jun 06 11:40:05 ws-study NetworkManager[1329]: <warn> [1780738805.5809] vpn[0x562e7bf4e510,4dc67d5c-53b8-40ae-9c07-bc2bd47ac6fe,"client"]: dbus: failure: connect-failed (1)
Jun 06 11:40:05 ws-study NetworkManager[1329]: <warn> [1780738805.5810] vpn[0x562e7bf4e510,4dc67d5c-53b8-40ae-9c07-bc2bd47ac6fe,"client"]: dbus: failure: connect-failed (1)
Jun 06 11:40:07 ws-study systemd[1]: Starting setroubleshootd.service - SETroubleshoot daemon for processing new SELinux denial logs...
Jun 06 11:40:07 ws-study audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=setroubleshootd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 06 11:40:07 ws-study systemd[1]: Started setroubleshootd.service - SETroubleshoot daemon for processing new SELinux denial logs.
Jun 06 11:40:08 ws-study systemd[1]: Started dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6.service.
Jun 06 11:40:08 ws-study audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 06 11:40:08 ws-study setroubleshoot[44337]: SELinux is preventing openvpn from open access on the file /home/j/Nextcloud/Documents/Keys and backups/Watchguard/client.crt. For complete SELinux messages run: sealert -l 83c7a029-f785-4dd4-b48f-1bee923e249b
Jun 06 11:40:08 ws-study setroubleshoot[44337]: SELinux is preventing openvpn from open access on the file /home/j/Nextcloud/Documents/Keys and backups/Watchguard/client.crt.
***** Plugin openvpn (47.5 confidence) suggests ***************************
If you want to mv client.crt to standard location so that openvpn can have open access
Then you must move the cert file to the ~/.cert directory
Do
# mv /home/j/Nextcloud/Documents/Keys and backups/Watchguard/client.crt ~/.cert
# restorecon -R -v ~/.cert
***** Plugin openvpn (47.5 confidence) suggests ***************************
If you want to modify the label on client.crt so that openvpn can have open access on it
Then you must fix the labels.
Do
# semanage fcontext -a -t home_cert_t /home/j/Nextcloud/Documents/Keys and backups/Watchguard/client.crt
# restorecon -R -v /home/j/Nextcloud/Documents/Keys and backups/Watchguard/client.crt
***** Plugin catchall (6.38 confidence) suggests **************************
If you believe that openvpn should be allowed open access on the client.crt file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'openvpn' --raw | audit2allow -M my-openvpn
# semodule -X 300 -i my-openvpn.pp
Jun 06 11:40:18 ws-study systemd[1]: dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6.service: Deactivated successfully.
Jun 06 11:40:18 ws-study audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 06 11:40:18 ws-study systemd[1]: setroubleshootd.service: Deactivated successfully.
Jun 06 11:40:18 ws-study audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=setroubleshootd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 06 11:40:18 ws-study systemd[1]: setroubleshootd.service: Consumed 552ms CPU time over 11.367s wall clock time, 77.8M memory peak.
**
Are you sure the SELinux denial in the journal doesn’t account for the failure to activate?
Do you get the same failure when running in SELinux permissive mode? (Quick way to test is to edit the command line in GRUB and specify enforcing=0)