This OpenVPN setup was configured by a prior provider, and it looks a little more customized than directions I have seen online.
The certificate has expired. It is self-signed, so we should just be able to extend the certificate without having to contact a Certificate Authority of any kind, but it does not seem to be working.
root@ovpn-1:/etc/openvpn# openssl x509 -req -days 720 -in ovpn-1.domain.net.csr -signkey ca/10_ovpn.domain.net/private/ca-key.pem -out ovpn-1.domain.net.cert
Signature ok
subject=/C=US/ST=New York/O=Company/CN=server
Getting Private key
root@ovpn-1:/etc/openvpn# /etc/init.d/openvpn restart
* Stopping virtual private network daemon(s)... * Stopping VPN 'openvpn' [ OK ]
* Starting virtual private network daemon(s)... * Autostarting VPN 'openvpn' [fail]
root@ovpn-1:/etc/openvpn# tail /var/log/openvpn/openvpn.log
Sat Jul 28 17:21:16 2012 us=215020 NOTE: --mute triggered...
Sat Jul 28 17:21:16 2012 us=215057 250 variation(s) on previous 20 message(s) suppressed by --mute
Sat Jul 28 17:21:16 2012 us=215080 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Sat Jul 28 17:21:16 2012 us=215204 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Sat Jul 28 17:21:16 2012 us=215222 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Sat Jul 28 17:21:16 2012 us=215354 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Jul 28 17:21:16 2012 us=257816 Diffie-Hellman initialized with 2048 bit key
Sat Jul 28 17:21:16 2012 us=258349 Cannot load private key file ovpn-1.domain.net.key: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
Sat Jul 28 17:21:16 2012 us=258395 Error: private key password verification failed
Sat Jul 28 17:21:16 2012 us=258418 Exiting
I feel I'm probably making a simple openssl mistaken but cannot find what it is. I am not touching the old files, just extending based on current files. I want to do this because there are 300+ people who have this VPN access and I don't want to have to send them all their certificates back, but at this point we've discussed re-doing the setup.
I hope this is enough to start offering suggestions.
Regards,
Doug
douglosey@gmail.com
