Hello openvpn users, I currently have an openvpn server that has a ca.crt that will expire in a few weeks. To keep the transition smooth, I decided to use [url=http://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains]stacked certificates[/url]. So first I generated a new ca.crt with: [code]openssl x509 -in origca.crt -days 720 -enddate -out newca.crt -signkey ca.key[/code] Then stacked both ca: [code]cat origca.crt newca.crt > ca.crt [/code] And restarted the server. The relevant server config lines are: [code]ca ca.crt cert ca.crt[/code] Then copied the new ca.crt, which now contains both old and new ca stacked, to a client. And now comes the problem, with the new ca.crt above they can connect but if I change it just to use the newca.crt it doesn't connect. Log from the client: [code]us=880839 UDPv4 link remote: [AF_INET]X.X.X.X:XXXX us=897026 TLS: Initial packet from [AF_INET]X.X.X.X:XXXX, sid=52e78d19 25ae783d us=57532 VERIFY ERROR: depth=0, error=self signed certificate: /O=CDC/CN=CDC_CN us=57614 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed us=57629 TLS Error: TLS object -> incoming plaintext read error us=57650 TLS Error: TLS handshake failed[/code] But verifiying with openssl works: [code] openssl verify -CAfile newca.crt -verbose client.crt client.crt: OK openssl verify -CAfile origca.crt -verbose client.crt client.crt: OK [/code] This should work right or am I doing something wrong? :? Any feedback is appreciated.

[quote="maikcat"] i think that in your server config this: cert ca.crt should use the cert you created using build-key-server script.. [/quote] Hi there Michael, I didn't use another certificate for this setup, so ca.crt is used as the server certificate.

Stacked certificates with CA

Colin

Hello openvpn users,
I currently have an openvpn server that has a ca.crt that will expire in a few weeks. To keep the transition smooth, I decided to use stacked certificates.
So first I generated a new ca.crt with:

openssl x509 -in origca.crt -days 720 -enddate -out newca.crt -signkey ca.key

Then stacked both ca:

cat origca.crt newca.crt > ca.crt

And restarted the server. The relevant server config lines are:

ca ca.crt
cert ca.crt

Then copied the new ca.crt, which now contains both old and new ca stacked, to a client.
And now comes the problem, with the new ca.crt above they can connect but if I change it just to use the newca.crt it doesn't connect. Log from the client:

us=880839 UDPv4 link remote: [AF_INET]X.X.X.X:XXXX
us=897026 TLS: Initial packet from [AF_INET]X.X.X.X:XXXX, sid=52e78d19 25ae783d
us=57532 VERIFY ERROR: depth=0, error=self signed certificate: /O=CDC/CN=CDC_CN
us=57614 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
us=57629 TLS Error: TLS object -> incoming plaintext read error
us=57650 TLS Error: TLS handshake failed

But verifiying with openssl works:

openssl verify -CAfile newca.crt -verbose client.crt
client.crt: OK
openssl verify -CAfile origca.crt -verbose client.crt
client.crt: OK

This should work right or am I doing something wrong? :?
Any feedback is appreciated.

maikcat

i think that in your server config this:

cert ca.crt

should use the cert you created using build-key-server script..

i never tested the mentioned setup though... :?

Michael.

Colin

maikcat wrote i think that in your server config this:
cert ca.crt
should use the cert you created using build-key-server script..

Hi there Michael,
I didn't use another certificate for this setup, so ca.crt is used as the server certificate.