Error in Generating the keys

nagarjun64

When i'm generating the key for the client i got these errors

"failed to update database
TXT_DB error number 2"

can u let me know why i'm getting this error

janjust

did you run

./clean-all

before creating any cerficates? if not, do so now. You can also do these manual steps after sourcing the 'vars' file:

mkdir $KEY_DIR
touch $KEY_DIR/index.txt
echo 01 > $KEY_DIR/serial

nagarjun64

Need help in Microsoft windows operating

janjust

then run the 'clean-all.bat' script. For more details read the HOWTO at
http://openvpn.net/index.php/open-source/documentation/howto.html#pki

jonm

Hi,
can somebody please help me with this.
I am using windows7 64 bit.

I had this problem with openvpn-install-2.3.0-I005-x86_64

I have just completely removed that and installed openvpn-install-2.3.1-I001-x86_64

I have not yet generated any config files to post.
All other files are as per the distribution.

From a command prompt I do this :-
init-config.bat

edit vars.bat to adapt it to my environment. Nothing changed.

vars
clean-all
vars
build-ca
vars
build-dh
vars
build-key-server dummy

All OK so far.
vars
build-key fred

The output ends like this:-

Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
Could Not Find C:\Program Files\OpenVPN\easy-rsa\keys\*.old

I have seeen a few posts about TXT_DB error number 2 but nothing resolves my problem.

From here on ALL builds give the same error.

All advice appreciated.

Thanks,

Jon

janjust

I cannot reproduce it on WinXP 32bit, will try Win7 64bit when I get my hands on one of these....

one thing to check: are you running the scripts as administrator/with elevated privs? it seems that the default permissions are a bit weird on the Win7 installs.

jonm

Hi,
thank you for the quick reply.

Yes i am running as an Administrator.

Also, i found this on a forum and added it to the end of vars.bat

rem Need this to get build to work Jm. Mar2013.
rem 11 april 2013, not sure if needed with 2.3.1
set RANDFILE=.rnd

It does not seem to make any difference.

Cheers,

Jon.

janjust

OK, managed to find a Win7 64bit laptop, installed openvpn 2.3.1 x86_64 and ran through the 'easy-rsa' scripts. I did use "Run as Administrator", and everything worked as expected.

Can you post the contents of the %KEY_DIR%\index.txt file ? Here are the contents of my index.txt file:

V       230415151223Z           01      unknown /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/CN=myServer
V       230415151307Z           02      unknown /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/CN=myClient

jonm

Hi,
server key generated. Failed to generate client key, as above.

index.txt is

V 230415145304Z 01 unknown /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain

Thanks,

Jon.

jonm

Repost using "code" instead of "quote"!

Hi,
server key generated. Failed to generate client key, as above.

index.txt is

V	230416071529Z		01	unknown	/C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain

Thanks,

Jon

janjust

aha, my guess is that you're trying to register the same certificate name (DN) twice; this is not allowed.

you're using all the default settings from the vars.bat file; it's better to change this to something meaninful *AND* you need to give each machine (server or client) a separate name. Hence for the 'Common Name' (which you are prompted for by the build-key-server.bat and build-key.bat files) I would choose something like 'myServer' and 'myClient'.

jonm

Hmmmmm,
immediately before I posted I uninstalled Openvpn, deleted all its directories, rebooted and reinstalled.
I get the same error if I put our own details in vars.bat.
The build that worked was

 build-key-server dummyserver

The next command, the one that failed, was

 build-key dummyclient

That was when I copied index.txt (above)
All subseqquent builds fail, all with a unique DN.

Puzzling!

btw doing most of this on windows7 ultimate, sp1, 64 bit.

Cheers,

Jon.

janjust

what did you enter during the "build-key" run? I had to fill in the common name, name, email address etc.

jonm

Well now I am looking really silly!
I was leaving the default email field (thinking it would be OK for testing).

Wrong, when I changed it (to jon@here.com) the build completed OK.

So hopefully all we be OK from here.

Thank you for all your time and help JJK. 😃

Cheers,

Jon.

ecrist

I know this is an old thread, but the error is due to a duplicate valid CN. You can have common names duplicate each other only when all others are revoked or expired.