Expired certificates

Scripts to manage certificates or generate config files

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Post Reply
funktiona
OpenVpn Newbie
Posts: 1
Joined: Wed Jun 21, 2023 12:44 pm

Expired certificates

Post by funktiona » Wed Jun 21, 2023 1:24 pm

I have been given the task to fix our certification problem, with no prior knowledge about OpenVPN.

Both the client and server certificates are expired, and I have no access to the clients. I don't even know if I have access to the root ca. Is there a way to know "who" the root ca is? All I got access to is the server and one client clone that is same as all other clients. I have gone through a couple of verify errors when trying stuff out on the server and client clone. Expired certificate, unable to get local issuer certificate. Now I don't get any verification error but still no luck. I edited the source code on the OpenVPN to accept old certificates on the server side. But my thinking is that the client does not accept the server certificate. I tried to create new certificate on the server side and that was when all errors went away. But still no connection.

I don't have much clue what to do and any tips will help :D

This is the latest error I get on the client side, it does not say to much
Wed Jun 21 12:40:25 2023 Attempting to establish TCP connection with [AF_INET]<IP> [nonblock]
Wed Jun 21 12:40:26 2023 TCP connection established with [AF_INET]<IP>
Wed Jun 21 12:40:26 2023 TCPv4_CLIENT link local: [undef]
Wed Jun 21 12:40:26 2023 TCPv4_CLIENT link remote: [AF_INET]<IP>
Wed Jun 21 12:40:26 2023 Connection reset, restarting [0]
Wed Jun 21 12:40:26 2023 SIGUSR1[soft,connection-reset] received, process restarting
Wed Jun 21 12:40:31 2023 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jun 21 12:40:31 2023 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jun 21 12:40:31 2023 Control Channel Authentication: using '/gs/cert/ta.key' as a OpenVPN static key file

rondeaut
OpenVpn Newbie
Posts: 7
Joined: Wed Jul 19, 2023 1:54 am

Re: Expired certificates

Post by rondeaut » Wed Jul 19, 2023 3:32 am

Hi funktiona, when the CA expires the usual response is to create a new CA cert, regenerate all the client certs and distribute them. You said that you created a new certificate on the server, did you create a new CA cert then generate a new client cert?

You said that you have no access to the clients, are you able to update the certs on them?

Post Reply