Signing certificate requests from remote users

biclops

Can someone tell me if I'm misunderstanding the general idea behind signing certificate requests?

I have remote users who need to be setup with OpenVPN credentials. I ask them to run a program on their computer that outputs a .req file (http://mycert.sandbox.cz/) and then email it to me. I tell them not to send me their .key file.

I then take that .req file, rename it to "client1.csr". Next, I sign it as follows using the same CA that created the server certificate:

$ . vars
$ ./pkitool --sign client1
Using configuration from openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'**'
stateOrProvinceName   :PRINTABLE:'**'
localityName          :PRINTABLE:'**'
organizationName      :PRINTABLE:'**'
organizationalUnitName:PRINTABLE:'**'
commonName            :PRINTABLE:'**'
emailAddress          :IA5STRING:'**'
Certificate is to be certified until Aug 21 18:52:48 2022 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
chmod: cannot access `client1.key': No such file or directory

I ignore the chmod error, as I don't have the key anyway. The file, "client1.crt", is produced.

Next, I send ca.crt, client1.crt, and a customized .ovpn configuration file to the client and instruct them to place those 3 files, plus the key they have, into the OpenVPN "config" dir.

So in testing, I get this far, but I get errors when I try to run OpenVPN as the client:

Thu Aug 23 12:00:12 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Aug 23 12:00:12 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Aug 23 12:00:15 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Aug 23 12:00:15 2012 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Aug 23 12:00:15 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 23 12:00:15 2012 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Thu Aug 23 12:00:15 2012 Local Options hash (VER=V4): 'db02a8f8'
Thu Aug 23 12:00:15 2012 Expected Remote Options hash (VER=V4): '7e068940'
Thu Aug 23 12:00:15 2012 Attempting to establish TCP connection with XXX.XXX.XXX.XXX:XXXX
Thu Aug 23 12:00:15 2012 TCP connection established with XXX.XXX.XXX.XXX:XXXX
Thu Aug 23 12:00:15 2012 TCPv4_CLIENT link local: [undef]
Thu Aug 23 12:00:15 2012 TCPv4_CLIENT link remote: XXX.XXX.XXX.XXX:XXXX
Thu Aug 23 12:00:15 2012 TLS: Initial packet from XXX.XXX.XXX.XXX:XXXX, sid=47911439 51a03eb1
Thu Aug 23 12:00:16 2012 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=XX/ST=XXXX/L=XXXX/O=XXXX/CN=XXX/emailAddress=XXX@XXX.XXX
Thu Aug 23 12:00:16 2012 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Thu Aug 23 12:00:16 2012 TLS Error: TLS object -> incoming plaintext read error
Thu Aug 23 12:00:16 2012 TLS Error: TLS handshake failed
Thu Aug 23 12:00:16 2012 Fatal TLS error (check_tls_errors_co), restarting
Thu Aug 23 12:00:16 2012 TCP/UDP: Closing socket
Thu Aug 23 12:00:16 2012 SIGUSR1[soft,tls-error] received, process restarting
Thu Aug 23 12:00:16 2012 Restart pause, 5 second(s)

My googling gives me the sense that not many people are doing what I'm doing the way I'm doing it, which leads me to believe I'm probably doing it all wrong. Or I'm simply signing the csr improperly.

Any comments or suggestions would be greatly appreciated!

maikcat

hi there,

VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=XX/ST=XXXX/L=XXXX/O=XXXX/CN=XXX/emailAddress=XXX@XXX.XXX

this

self signed certificate in certificate chain

troubles me...

can you give these:

openssl x509 -in client1.crt -issuer | head -1
openssl x509 -in client1.crt -subject | head -1

if the 2 output lines are the same then your cert is self-signed... :?

Michael.

biclops

Hi Michael,

Below is the output, censored a little bit:

issuer= /C=CA/ST=British Columbia/L=Vancouver/O=MyOrg/CN=My Server/emailAddress=admin@myserver.com
subject= /C=ca/ST=British Columbia/L=Vancouver/O=MyOrg/OU=VPN/CN=Client1 Name/emailAddress=client1@myorg.com

Just to clarify, I do use a private, self-signed CA - which I believe is fine provided I intend to hand out the ca.crt file to any clients I set up. But correct me if I've got this wrong.

maikcat

Just to clarify, I do use a private, self-signed CA - which I believe is fine provided I intend to hand out the ca.crt file to any clients I set up. But correct me if I've got this wrong.

no you are not wrong...

can you post your cilent config and server log using verb 4 and above?

Michael.

biclops

Hi Michael,

I did make some changes, so I'll paste both configs, and both logs:

client.ovpn:

client
dev tun
proto udp
remote xxx.xxx.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 4

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.20.0 255.255.255.0"
client-config-dir ccd
route 192.168.2.0 255.255.255.0
push "dhcp-option DOMAIN my.domain"
push "dhcp-option DNS 192.168.20.18"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 4

Client log:

Tue Aug 28 14:11:34 2012 us=828000 Current Parameter Settings:
Tue Aug 28 14:11:34 2012 us=828000   config = 'client - Copy.ovpn'
Tue Aug 28 14:11:34 2012 us=828000   mode = 0
Tue Aug 28 14:11:34 2012 us=828000   show_ciphers = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   show_digests = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   show_engines = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   genkey = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   key_pass_file = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   show_tls_ciphers = DISABLED
Tue Aug 28 14:11:34 2012 us=828000 Connection profiles [default]:
Tue Aug 28 14:11:34 2012 us=828000   proto = udp
Tue Aug 28 14:11:34 2012 us=828000   local = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   local_port = 0
Tue Aug 28 14:11:34 2012 us=828000   remote = 'xxx.xxx.com'
Tue Aug 28 14:11:34 2012 us=828000   remote_port = 1194
Tue Aug 28 14:11:34 2012 us=828000   remote_float = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   bind_defined = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   bind_local = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   connect_retry_seconds = 5
Tue Aug 28 14:11:34 2012 us=828000   connect_timeout = 10
Tue Aug 28 14:11:34 2012 us=828000   connect_retry_max = 0
Tue Aug 28 14:11:34 2012 us=828000   socks_proxy_server = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   socks_proxy_port = 0
Tue Aug 28 14:11:34 2012 us=828000   socks_proxy_retry = DISABLED
Tue Aug 28 14:11:34 2012 us=828000 Connection profiles END
Tue Aug 28 14:11:34 2012 us=828000   remote_random = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   ipchange = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   dev = 'tun'
Tue Aug 28 14:11:34 2012 us=828000   dev_type = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   dev_node = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   lladdr = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   topology = 1
Tue Aug 28 14:11:34 2012 us=828000   tun_ipv6 = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   ifconfig_local = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   ifconfig_remote_netmask = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   ifconfig_noexec = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   ifconfig_nowarn = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   shaper = 0
Tue Aug 28 14:11:34 2012 us=828000   tun_mtu = 1500
Tue Aug 28 14:11:34 2012 us=828000   tun_mtu_defined = ENABLED
Tue Aug 28 14:11:34 2012 us=828000   link_mtu = 1500
Tue Aug 28 14:11:34 2012 us=828000   link_mtu_defined = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   tun_mtu_extra = 0
Tue Aug 28 14:11:34 2012 us=828000   tun_mtu_extra_defined = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   fragment = 0
Tue Aug 28 14:11:34 2012 us=828000   mtu_discover_type = -1
Tue Aug 28 14:11:34 2012 us=828000   mtu_test = 0
Tue Aug 28 14:11:34 2012 us=828000   mlock = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   keepalive_ping = 0
Tue Aug 28 14:11:34 2012 us=828000   keepalive_timeout = 0
Tue Aug 28 14:11:34 2012 us=828000   inactivity_timeout = 0
Tue Aug 28 14:11:34 2012 us=828000   ping_send_timeout = 0
Tue Aug 28 14:11:34 2012 us=828000   ping_rec_timeout = 0
Tue Aug 28 14:11:34 2012 us=828000   ping_rec_timeout_action = 0
Tue Aug 28 14:11:34 2012 us=828000   ping_timer_remote = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   remap_sigusr1 = 0
Tue Aug 28 14:11:34 2012 us=828000   explicit_exit_notification = 0
Tue Aug 28 14:11:34 2012 us=828000   persist_tun = ENABLED
Tue Aug 28 14:11:34 2012 us=828000   persist_local_ip = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   persist_remote_ip = DISABLED
Tue Aug 28 14:11:34 2012 us=828000   persist_key = ENABLED
Tue Aug 28 14:11:34 2012 us=828000   mssfix = 1450
Tue Aug 28 14:11:34 2012 us=828000   resolve_retry_seconds = 1000000000
Tue Aug 28 14:11:34 2012 us=828000   username = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   groupname = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   chroot_dir = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   cd_dir = '[UNDEF]'
Tue Aug 28 14:11:34 2012 us=828000   writepid = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=31000   up_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=31000   down_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=31000   down_pre = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   up_restart = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   up_delay = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   daemon = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   inetd = 0
Tue Aug 28 14:11:35 2012 us=31000   log = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   suppress_timestamps = DISABLED
Tue Aug 28 14:11:35 2012 us=31000   nice = 0
Tue Aug 28 14:11:35 2012 us=31000   verbosity = 4
Tue Aug 28 14:11:35 2012 us=31000   mute = 0
Tue Aug 28 14:11:35 2012 us=31000   gremlin = 0
Tue Aug 28 14:11:35 2012 us=31000   status_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=31000   status_file_version = 1
Tue Aug 28 14:11:35 2012 us=31000   status_file_update_freq = 60
Tue Aug 28 14:11:35 2012 us=31000   occ = ENABLED
Tue Aug 28 14:11:35 2012 us=31000   rcvbuf = 0
Tue Aug 28 14:11:35 2012 us=31000   sndbuf = 0
Tue Aug 28 14:11:35 2012 us=93000   sockflags = 0
Tue Aug 28 14:11:35 2012 us=93000   fast_io = DISABLED
Tue Aug 28 14:11:35 2012 us=93000   lzo = 7
Tue Aug 28 14:11:35 2012 us=93000   route_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=93000   route_default_gateway = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=93000   route_default_metric = 0
Tue Aug 28 14:11:35 2012 us=93000   route_noexec = DISABLED
Tue Aug 28 14:11:35 2012 us=93000   route_delay = 5
Tue Aug 28 14:11:35 2012 us=93000   route_delay_window = 30
Tue Aug 28 14:11:35 2012 us=93000   route_delay_defined = ENABLED
Tue Aug 28 14:11:35 2012 us=93000   route_nopull = DISABLED
Tue Aug 28 14:11:35 2012 us=93000   route_gateway_via_dhcp = DISABLED
Tue Aug 28 14:11:35 2012 us=93000   max_routes = 100
Tue Aug 28 14:11:35 2012 us=93000   allow_pull_fqdn = DISABLED
Tue Aug 28 14:11:35 2012 us=93000   management_addr = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=93000   management_port = 0
Tue Aug 28 14:11:35 2012 us=93000   management_user_pass = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=140000   management_log_history_cache = 250
Tue Aug 28 14:11:35 2012 us=140000   management_echo_buffer_size = 100
Tue Aug 28 14:11:35 2012 us=140000   management_write_peer_info_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=140000   management_client_user = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=140000   management_client_group = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=140000   management_flags = 0
Tue Aug 28 14:11:35 2012 us=140000   shared_secret_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=140000   key_direction = 0
Tue Aug 28 14:11:35 2012 us=140000   ciphername_defined = ENABLED
Tue Aug 28 14:11:35 2012 us=140000   ciphername = 'BF-CBC'
Tue Aug 28 14:11:35 2012 us=140000   authname_defined = ENABLED
Tue Aug 28 14:11:35 2012 us=140000   authname = 'SHA1'
Tue Aug 28 14:11:35 2012 us=140000   prng_hash = 'SHA1'
Tue Aug 28 14:11:35 2012 us=140000   prng_nonce_secret_len = 16
Tue Aug 28 14:11:35 2012 us=140000   keysize = 0
Tue Aug 28 14:11:35 2012 us=140000   engine = DISABLED
Tue Aug 28 14:11:35 2012 us=218000   replay = ENABLED
Tue Aug 28 14:11:35 2012 us=218000   mute_replay_warnings = DISABLED
Tue Aug 28 14:11:35 2012 us=218000   replay_window = 64
Tue Aug 28 14:11:35 2012 us=218000   replay_time = 15
Tue Aug 28 14:11:35 2012 us=218000   packet_id_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=218000   use_iv = ENABLED
Tue Aug 28 14:11:35 2012 us=218000   test_crypto = DISABLED
Tue Aug 28 14:11:35 2012 us=218000   tls_server = DISABLED
Tue Aug 28 14:11:35 2012 us=218000   tls_client = ENABLED
Tue Aug 28 14:11:35 2012 us=218000   key_method = 2
Tue Aug 28 14:11:35 2012 us=218000   ca_file = 'ca.crt'
Tue Aug 28 14:11:35 2012 us=218000   ca_path = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=218000   dh_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=218000   cert_file = 'client.crt'
Tue Aug 28 14:11:35 2012 us=218000   priv_key_file = 'client.key'
Tue Aug 28 14:11:35 2012 us=218000   pkcs12_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=218000   cryptoapi_cert = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   cipher_list = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   tls_verify = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   tls_export_cert = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   tls_remote = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   crl_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=250000   ns_cert_type = 64
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=250000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_ku[i] = 0
Tue Aug 28 14:11:35 2012 us=328000   remote_cert_eku = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=328000   tls_timeout = 2
Tue Aug 28 14:11:35 2012 us=328000   renegotiate_bytes = 0
Tue Aug 28 14:11:35 2012 us=328000   renegotiate_packets = 0
Tue Aug 28 14:11:35 2012 us=328000   renegotiate_seconds = 3600
Tue Aug 28 14:11:35 2012 us=328000   handshake_window = 60
Tue Aug 28 14:11:35 2012 us=328000   transition_window = 3600
Tue Aug 28 14:11:35 2012 us=328000   single_session = DISABLED
Tue Aug 28 14:11:35 2012 us=328000   push_peer_info = DISABLED
Tue Aug 28 14:11:35 2012 us=328000   tls_exit = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   tls_auth_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=359000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_protected_authentication = DISABLED
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=421000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_private_mode = 00000000
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=500000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_cert_private = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_pin_cache_period = -1
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_id = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=515000   pkcs11_id_management = DISABLED
Tue Aug 28 14:11:35 2012 us=515000   server_network = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=515000   server_netmask = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=515000   server_bridge_ip = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=515000   server_bridge_netmask = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   server_bridge_pool_start = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   server_bridge_pool_end = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_defined = DISABLED
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_start = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_end = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_netmask = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=578000   ifconfig_pool_persist_refresh_freq = 600
Tue Aug 28 14:11:35 2012 us=578000   n_bcast_buf = 256
Tue Aug 28 14:11:35 2012 us=578000   tcp_queue_limit = 64
Tue Aug 28 14:11:35 2012 us=578000   real_hash_size = 256
Tue Aug 28 14:11:35 2012 us=578000   virtual_hash_size = 256
Tue Aug 28 14:11:35 2012 us=578000   client_connect_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=578000   learn_address_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=625000   client_disconnect_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=625000   client_config_dir = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=625000   ccd_exclusive = DISABLED
Tue Aug 28 14:11:35 2012 us=625000   tmp_dir = 'C:\Users\biclops\AppData\Local\Temp\'
Tue Aug 28 14:11:35 2012 us=625000   push_ifconfig_defined = DISABLED
Tue Aug 28 14:11:35 2012 us=625000   push_ifconfig_local = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=625000   push_ifconfig_remote_netmask = 0.0.0.0
Tue Aug 28 14:11:35 2012 us=625000   enable_c2c = DISABLED
Tue Aug 28 14:11:35 2012 us=625000   duplicate_cn = DISABLED
Tue Aug 28 14:11:35 2012 us=625000   cf_max = 0
Tue Aug 28 14:11:35 2012 us=625000   cf_per = 0
Tue Aug 28 14:11:35 2012 us=625000   max_clients = 1024
Tue Aug 28 14:11:35 2012 us=625000   max_routes_per_client = 256
Tue Aug 28 14:11:35 2012 us=625000   auth_user_pass_verify_script = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=687000   auth_user_pass_verify_script_via_file = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   ssl_flags = 0
Tue Aug 28 14:11:35 2012 us=687000   client = ENABLED
Tue Aug 28 14:11:35 2012 us=687000   pull = ENABLED
Tue Aug 28 14:11:35 2012 us=687000   auth_user_pass_file = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=687000   show_net_up = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   route_method = 0
Tue Aug 28 14:11:35 2012 us=687000   ip_win32_defined = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   ip_win32_type = 3
Tue Aug 28 14:11:35 2012 us=687000   dhcp_masq_offset = 0
Tue Aug 28 14:11:35 2012 us=687000   dhcp_lease_time = 31536000
Tue Aug 28 14:11:35 2012 us=687000   tap_sleep = 0
Tue Aug 28 14:11:35 2012 us=687000   dhcp_options = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   dhcp_renew = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   dhcp_pre_release = DISABLED
Tue Aug 28 14:11:35 2012 us=687000   dhcp_release = DISABLED
Tue Aug 28 14:11:35 2012 us=718000   domain = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=718000   netbios_scope = '[UNDEF]'
Tue Aug 28 14:11:35 2012 us=718000   netbios_node_type = 0
Tue Aug 28 14:11:35 2012 us=718000   disable_nbt = DISABLED
Tue Aug 28 14:11:35 2012 us=718000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Aug 28 14:11:35 2012 us=718000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 28 14:11:56 2012 us=375000 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 28 14:11:56 2012 us=375000 LZO compression initialized
Tue Aug 28 14:11:56 2012 us=375000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Aug 28 14:11:56 2012 us=375000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Aug 28 14:11:56 2012 us=421000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 28 14:11:56 2012 us=437000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Aug 28 14:11:56 2012 us=437000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Aug 28 14:11:56 2012 us=437000 Local Options hash (VER=V4): '41690919'
Tue Aug 28 14:11:56 2012 us=437000 Expected Remote Options hash (VER=V4): '530fdded'
Tue Aug 28 14:11:56 2012 us=437000 UDPv4 link local: [undef]
Tue Aug 28 14:11:56 2012 us=437000 UDPv4 link remote: XXX.XXX.XXX.XXX:1194
Tue Aug 28 14:11:56 2012 us=500000 TLS: Initial packet from XXX.XXX.XXX.XXX:1194, sid=098c7e6e 2248bfe5
Tue Aug 28 14:11:56 2012 us=734000 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=CA/ST=British Columbia/L=Vancouver/O=MyOrg/CN=My Server/emailAddress=admin@myserver.com
Tue Aug 28 14:11:56 2012 us=734000 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Tue Aug 28 14:11:56 2012 us=734000 TLS Error: TLS object -> incoming plaintext read error
Tue Aug 28 14:11:56 2012 us=734000 TLS Error: TLS handshake failed
Tue Aug 28 14:11:56 2012 us=734000 TCP/UDP: Closing socket
Tue Aug 28 14:11:56 2012 us=734000 SIGUSR1[soft,tls-error] received, process restarting
Tue Aug 28 14:11:56 2012 us=750000 Restart pause, 2 second(s)

Server log:

Tue Aug 28 13:57:54 2012 us=524955 Current Parameter Settings:
Tue Aug 28 13:57:54 2012 us=525378   config = '../server.conf'
Tue Aug 28 13:57:54 2012 us=525434   mode = 1
Tue Aug 28 13:57:54 2012 us=525485   persist_config = DISABLED
Tue Aug 28 13:57:54 2012 us=525534   persist_mode = 1
Tue Aug 28 13:57:54 2012 us=525584   show_ciphers = DISABLED
Tue Aug 28 13:57:54 2012 us=525633   show_digests = DISABLED
Tue Aug 28 13:57:54 2012 us=525683   show_engines = DISABLED
Tue Aug 28 13:57:54 2012 us=525752   genkey = DISABLED
Tue Aug 28 13:57:54 2012 us=525802   key_pass_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=525852   show_tls_ciphers = DISABLED
Tue Aug 28 13:57:54 2012 us=525909 Connection profiles [default]:
Tue Aug 28 13:57:54 2012 us=525961   proto = udp
Tue Aug 28 13:57:54 2012 us=526011   local = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526061   local_port = 1194
Tue Aug 28 13:57:54 2012 us=526113   remote = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526163   remote_port = 1194
Tue Aug 28 13:57:54 2012 us=526213   remote_float = DISABLED
Tue Aug 28 13:57:54 2012 us=526262   bind_defined = DISABLED
Tue Aug 28 13:57:54 2012 us=526312   bind_local = ENABLED
Tue Aug 28 13:57:54 2012 us=526363   connect_retry_seconds = 5
Tue Aug 28 13:57:54 2012 us=526413   connect_timeout = 10
Tue Aug 28 13:57:54 2012 us=526463   connect_retry_max = 0
Tue Aug 28 13:57:54 2012 us=526513   socks_proxy_server = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526564   socks_proxy_port = 0
Tue Aug 28 13:57:54 2012 us=526613   socks_proxy_retry = DISABLED
Tue Aug 28 13:57:54 2012 us=526667 Connection profiles END
Tue Aug 28 13:57:54 2012 us=526732   remote_random = DISABLED
Tue Aug 28 13:57:54 2012 us=526783   ipchange = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526832   dev = 'tun'
Tue Aug 28 13:57:54 2012 us=526897   dev_type = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526949   dev_node = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=526999   lladdr = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=527049   topology = 1
Tue Aug 28 13:57:54 2012 us=527098   tun_ipv6 = DISABLED
Tue Aug 28 13:57:54 2012 us=527148   ifconfig_local = '10.8.0.1'
Tue Aug 28 13:57:54 2012 us=527199   ifconfig_remote_netmask = '10.8.0.2'
Tue Aug 28 13:57:54 2012 us=527248   ifconfig_noexec = DISABLED
Tue Aug 28 13:57:54 2012 us=527298   ifconfig_nowarn = DISABLED
Tue Aug 28 13:57:54 2012 us=527348   shaper = 0
Tue Aug 28 13:57:54 2012 us=527397   tun_mtu = 1500
Tue Aug 28 13:57:54 2012 us=527447   tun_mtu_defined = ENABLED
Tue Aug 28 13:57:54 2012 us=527497   link_mtu = 1500
Tue Aug 28 13:57:54 2012 us=527547   link_mtu_defined = DISABLED
Tue Aug 28 13:57:54 2012 us=527597   tun_mtu_extra = 0
Tue Aug 28 13:57:54 2012 us=527647   tun_mtu_extra_defined = DISABLED
Tue Aug 28 13:57:54 2012 us=527697   fragment = 0
Tue Aug 28 13:57:54 2012 us=527760   mtu_discover_type = -1
Tue Aug 28 13:57:54 2012 us=527810   mtu_test = 0
Tue Aug 28 13:57:54 2012 us=527858   mlock = DISABLED
Tue Aug 28 13:57:54 2012 us=527909   keepalive_ping = 10
Tue Aug 28 13:57:54 2012 us=527959   keepalive_timeout = 120
Tue Aug 28 13:57:54 2012 us=528009   inactivity_timeout = 0
Tue Aug 28 13:57:54 2012 us=528059   ping_send_timeout = 10
Tue Aug 28 13:57:54 2012 us=528109   ping_rec_timeout = 240
Tue Aug 28 13:57:54 2012 us=528159   ping_rec_timeout_action = 2
Tue Aug 28 13:57:54 2012 us=528209   ping_timer_remote = DISABLED
Tue Aug 28 13:57:54 2012 us=528259   remap_sigusr1 = 0
Tue Aug 28 13:57:54 2012 us=528310   explicit_exit_notification = 0
Tue Aug 28 13:57:54 2012 us=528360   persist_tun = ENABLED
Tue Aug 28 13:57:54 2012 us=528410   persist_local_ip = DISABLED
Tue Aug 28 13:57:54 2012 us=528460   persist_remote_ip = DISABLED
Tue Aug 28 13:57:54 2012 us=528510   persist_key = ENABLED
Tue Aug 28 13:57:54 2012 us=528560   mssfix = 1450
Tue Aug 28 13:57:54 2012 us=528609   passtos = DISABLED
Tue Aug 28 13:57:54 2012 us=528660   resolve_retry_seconds = 1000000000
Tue Aug 28 13:57:54 2012 us=528721   username = 'nobody'
Tue Aug 28 13:57:54 2012 us=528771   groupname = 'nobody'
Tue Aug 28 13:57:54 2012 us=528821   chroot_dir = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=528870   cd_dir = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=529012   writepid = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=529065   up_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=529114   down_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=529164   down_pre = DISABLED
Tue Aug 28 13:57:54 2012 us=529213   up_restart = DISABLED
Tue Aug 28 13:57:54 2012 us=529263   up_delay = DISABLED
Tue Aug 28 13:57:54 2012 us=529313   daemon = DISABLED
Tue Aug 28 13:57:54 2012 us=529363   inetd = 0
Tue Aug 28 13:57:54 2012 us=529412   log = DISABLED
Tue Aug 28 13:57:54 2012 us=529462   suppress_timestamps = DISABLED
Tue Aug 28 13:57:54 2012 us=529512   nice = 0
Tue Aug 28 13:57:54 2012 us=529562   verbosity = 4
Tue Aug 28 13:57:54 2012 us=529611   mute = 0
Tue Aug 28 13:57:54 2012 us=529661   gremlin = 0
Tue Aug 28 13:57:54 2012 us=529725   status_file = 'openvpn-status.log'
Tue Aug 28 13:57:54 2012 us=529777   status_file_version = 1
Tue Aug 28 13:57:54 2012 us=529828   status_file_update_freq = 60
Tue Aug 28 13:57:54 2012 us=529877   occ = ENABLED
Tue Aug 28 13:57:54 2012 us=529927   rcvbuf = 65536
Tue Aug 28 13:57:54 2012 us=529977   sndbuf = 65536
Tue Aug 28 13:57:54 2012 us=530026   sockflags = 0
Tue Aug 28 13:57:54 2012 us=530075   fast_io = DISABLED
Tue Aug 28 13:57:54 2012 us=530124   lzo = 7
Tue Aug 28 13:57:54 2012 us=530174   route_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=530224   route_default_gateway = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=530275   route_default_metric = 0
Tue Aug 28 13:57:54 2012 us=530324   route_noexec = DISABLED
Tue Aug 28 13:57:54 2012 us=530374   route_delay = 0
Tue Aug 28 13:57:54 2012 us=530425   route_delay_window = 30
Tue Aug 28 13:57:54 2012 us=530474   route_delay_defined = DISABLED
Tue Aug 28 13:57:54 2012 us=530525   route_nopull = DISABLED
Tue Aug 28 13:57:54 2012 us=530575   route_gateway_via_dhcp = DISABLED
Tue Aug 28 13:57:54 2012 us=530626   max_routes = 100
Tue Aug 28 13:57:54 2012 us=530676   allow_pull_fqdn = DISABLED
Tue Aug 28 13:57:54 2012 us=530743   route 192.168.2.0/255.255.255.0/nil/nil
Tue Aug 28 13:57:54 2012 us=530795   route 10.8.0.0/255.255.255.0/nil/nil
Tue Aug 28 13:57:54 2012 us=530846   management_addr = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=530897   management_port = 0
Tue Aug 28 13:57:54 2012 us=530948   management_user_pass = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=531000   management_log_history_cache = 250
Tue Aug 28 13:57:54 2012 us=531051   management_echo_buffer_size = 100
Tue Aug 28 13:57:54 2012 us=531102   management_write_peer_info_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=531153   management_client_user = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=531204   management_client_group = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=531255   management_flags = 0
Tue Aug 28 13:57:54 2012 us=531306   shared_secret_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=531356   key_direction = 0
Tue Aug 28 13:57:54 2012 us=531407   ciphername_defined = ENABLED
Tue Aug 28 13:57:54 2012 us=531457   ciphername = 'BF-CBC'
Tue Aug 28 13:57:54 2012 us=531508   authname_defined = ENABLED
Tue Aug 28 13:57:54 2012 us=531558   authname = 'SHA1'
Tue Aug 28 13:57:54 2012 us=531608   prng_hash = 'SHA1'
Tue Aug 28 13:57:54 2012 us=531659   prng_nonce_secret_len = 16
Tue Aug 28 13:57:54 2012 us=531721   keysize = 0
Tue Aug 28 13:57:54 2012 us=531772   engine = DISABLED
Tue Aug 28 13:57:54 2012 us=531822   replay = ENABLED
Tue Aug 28 13:57:54 2012 us=531873   mute_replay_warnings = DISABLED
Tue Aug 28 13:57:54 2012 us=531924   replay_window = 64
Tue Aug 28 13:57:54 2012 us=531974   replay_time = 15
Tue Aug 28 13:57:54 2012 us=532025   packet_id_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532075   use_iv = ENABLED
Tue Aug 28 13:57:54 2012 us=532125   test_crypto = DISABLED
Tue Aug 28 13:57:54 2012 us=532175   tls_server = ENABLED
Tue Aug 28 13:57:54 2012 us=532225   tls_client = DISABLED
Tue Aug 28 13:57:54 2012 us=532275   key_method = 2
Tue Aug 28 13:57:54 2012 us=532325   ca_file = 'ca.crt'
Tue Aug 28 13:57:54 2012 us=532375   ca_path = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532425   dh_file = 'dh1024.pem'
Tue Aug 28 13:57:54 2012 us=532566   cert_file = 'server.crt'
Tue Aug 28 13:57:54 2012 us=532621   priv_key_file = 'server.key'
Tue Aug 28 13:57:54 2012 us=532672   pkcs12_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532736   cipher_list = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532787   tls_verify = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532838   tls_remote = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532888   crl_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=532938   ns_cert_type = 0
Tue Aug 28 13:57:54 2012 us=532990   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533041   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533091   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533142   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533193   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533245   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533296   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533346   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533396   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533447   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533498   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533548   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533599   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533650   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533712   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533764   remote_cert_ku[i] = 0
Tue Aug 28 13:57:54 2012 us=533815   remote_cert_eku = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=533865   tls_timeout = 2
Tue Aug 28 13:57:54 2012 us=533915   renegotiate_bytes = 0
Tue Aug 28 13:57:54 2012 us=533967   renegotiate_packets = 0
Tue Aug 28 13:57:54 2012 us=534017   renegotiate_seconds = 3600
Tue Aug 28 13:57:54 2012 us=534068   handshake_window = 60
Tue Aug 28 13:57:54 2012 us=534118   transition_window = 3600
Tue Aug 28 13:57:54 2012 us=534167   single_session = DISABLED
Tue Aug 28 13:57:54 2012 us=534217   tls_exit = DISABLED
Tue Aug 28 13:57:54 2012 us=534267   tls_auth_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=534326   server_network = 10.8.0.0
Tue Aug 28 13:57:54 2012 us=534383   server_netmask = 255.255.255.0
Tue Aug 28 13:57:54 2012 us=534439   server_bridge_ip = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=534495   server_bridge_netmask = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=534551   server_bridge_pool_start = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=534607   server_bridge_pool_end = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=534658   push_entry = 'route 192.168.20.0 255.255.255.0'
Tue Aug 28 13:57:54 2012 us=534721   push_entry = 'dhcp-option DOMAIN my.domain'
Tue Aug 28 13:57:54 2012 us=534774   push_entry = 'dhcp-option DNS 192.168.20.18'
Tue Aug 28 13:57:54 2012 us=534829   push_entry = 'route 10.8.0.1'
Tue Aug 28 13:57:54 2012 us=534879   push_entry = 'topology net30'
Tue Aug 28 13:57:54 2012 us=534930   push_entry = 'ping 10'
Tue Aug 28 13:57:54 2012 us=534980   push_entry = 'ping-restart 120'
Tue Aug 28 13:57:54 2012 us=535031   ifconfig_pool_defined = ENABLED
Tue Aug 28 13:57:54 2012 us=535087   ifconfig_pool_start = 10.8.0.4
Tue Aug 28 13:57:54 2012 us=535143   ifconfig_pool_end = 10.8.0.251
Tue Aug 28 13:57:54 2012 us=535199   ifconfig_pool_netmask = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=535250   ifconfig_pool_persist_filename = 'ipp.txt'
Tue Aug 28 13:57:54 2012 us=535302   ifconfig_pool_persist_refresh_freq = 600
Tue Aug 28 13:57:54 2012 us=535353   n_bcast_buf = 256
Tue Aug 28 13:57:54 2012 us=535403   tcp_queue_limit = 64
Tue Aug 28 13:57:54 2012 us=535454   real_hash_size = 256
Tue Aug 28 13:57:54 2012 us=535505   virtual_hash_size = 256
Tue Aug 28 13:57:54 2012 us=535555   client_connect_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=535606   learn_address_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=535658   client_disconnect_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=535719   client_config_dir = 'ccd'
Tue Aug 28 13:57:54 2012 us=535770   ccd_exclusive = DISABLED
Tue Aug 28 13:57:54 2012 us=535820   tmp_dir = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=535870   push_ifconfig_defined = DISABLED
Tue Aug 28 13:57:54 2012 us=536011   push_ifconfig_local = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=536069   push_ifconfig_remote_netmask = 0.0.0.0
Tue Aug 28 13:57:54 2012 us=536120   enable_c2c = DISABLED
Tue Aug 28 13:57:54 2012 us=536170   duplicate_cn = DISABLED
Tue Aug 28 13:57:54 2012 us=536220   cf_max = 0
Tue Aug 28 13:57:54 2012 us=536271   cf_per = 0
Tue Aug 28 13:57:54 2012 us=536321   max_clients = 1024
Tue Aug 28 13:57:54 2012 us=536371   max_routes_per_client = 256
Tue Aug 28 13:57:54 2012 us=536422   auth_user_pass_verify_script = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=536473   auth_user_pass_verify_script_via_file = DISABLED
Tue Aug 28 13:57:54 2012 us=536524   ssl_flags = 0
Tue Aug 28 13:57:54 2012 us=536574   port_share_host = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=536625   port_share_port = 0
Tue Aug 28 13:57:54 2012 us=536675   client = DISABLED
Tue Aug 28 13:57:54 2012 us=536740   pull = DISABLED
Tue Aug 28 13:57:54 2012 us=536790   auth_user_pass_file = '[UNDEF]'
Tue Aug 28 13:57:54 2012 us=536854 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Mar 19 2010
Tue Aug 28 13:57:54 2012 us=537462 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 28 13:57:54 2012 us=592410 Diffie-Hellman initialized with 1024 bit key
Tue Aug 28 13:57:54 2012 us=596321 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Aug 28 13:57:54 2012 us=597055 ROUTE default_gateway=192.168.20.254
Tue Aug 28 13:57:54 2012 us=607830 TUN/TAP device tun0 opened
Tue Aug 28 13:57:54 2012 us=608068 TUN/TAP TX queue length set to 100
Tue Aug 28 13:57:54 2012 us=608260 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Aug 28 13:57:54 2012 us=613598 /sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Aug 28 13:57:54 2012 us=617132 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Aug 28 13:57:54 2012 us=620204 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 28 13:57:54 2012 us=621656 GID set to nobody
Tue Aug 28 13:57:54 2012 us=621816 UID set to nobody
Tue Aug 28 13:57:54 2012 us=621907 Socket Buffers: R=[110592->131072] S=[110592->131072]
Tue Aug 28 13:57:54 2012 us=621975 UDPv4 link local (bound): [undef]:1194
Tue Aug 28 13:57:54 2012 us=622023 UDPv4 link remote: [undef]
Tue Aug 28 13:57:54 2012 us=622103 MULTI: multi_init called, r=256 v=256
Tue Aug 28 13:57:54 2012 us=622280 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Aug 28 13:57:54 2012 us=622466 IFCONFIG POOL LIST
Tue Aug 28 13:57:54 2012 us=622520 hardhead,10.8.0.4
Tue Aug 28 13:57:54 2012 us=623007 Initialization Sequence Completed
Tue Aug 28 14:01:07 2012 us=493289 MULTI: multi_create_instance called
Tue Aug 28 14:01:07 2012 us=493580 XXX.XXX.XXX.XXX:60704 Re-using SSL/TLS context
Tue Aug 28 14:01:07 2012 us=493697 XXX.XXX.XXX.XXX:60704 LZO compression initialized
Tue Aug 28 14:01:07 2012 us=494332 XXX.XXX.XXX.XXX:60704 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Aug 28 14:01:07 2012 us=495985 XXX.XXX.XXX.XXX:60704 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 28 14:01:07 2012 us=497705 XXX.XXX.XXX.XXX:60704 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Aug 28 14:01:07 2012 us=497779 XXX.XXX.XXX.XXX:60704 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Aug 28 14:01:07 2012 us=497911 XXX.XXX.XXX.XXX:60704 Local Options hash (VER=V4): '530fdded'
Tue Aug 28 14:01:07 2012 us=497996 XXX.XXX.XXX.XXX:60704 Expected Remote Options hash (VER=V4): '41690919'
Tue Aug 28 14:01:07 2012 us=498365 XXX.XXX.XXX.XXX:60704 TLS: Initial packet from XXX.XXX.XXX.XXX:60704, sid=046a9f97 da4b87c9

Thanks again

maikcat

hi there,

if you create a cert and hand it over to your client,is he connecting normally?

also can you describe the proccess followed when you created server certs?

thank you.

Michael.

biclops

Hi Michael,

(FYI, for the purpose of getting this working, I'm both the server and the client.)

To create a certificate request, the client uses this very simple, windows-based program: http://mycert.sandbox.cz/. It produces a .key file and .req file. The client sends me the .req file and I sign it per my first post:

$ . vars
$ ./pkitool --sign client1
Using configuration from openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'**'
stateOrProvinceName   :PRINTABLE:'**'
localityName          :PRINTABLE:'**'
organizationName      :PRINTABLE:'**'
organizationalUnitName:PRINTABLE:'**'
commonName            :PRINTABLE:'**'
emailAddress          :IA5STRING:'**'
Certificate is to be certified until Aug 21 18:52:48 2022 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
chmod: cannot access `client1.key': No such file or directory

As for connecting, the client takes the .key file he created, and the ca.crt, client.crt, and client.ovpn provided by me, and places it in his openvpn/config dir. The connection is attempted using Openvpn GUI run as administrator. Is this what you were asking for?

Just to step back from this particular problem for a moment, the end goal is to set up my non-tech colleages with OpenVPN credentials in a way that doesn't transmit either their key or passphrase in the clear. The only user-friendly method I've found is the Windows program that I linked to, "mycert". However, if there's a better way to do this that I've overlooked, I'm all ears.

Thanks

biclops

Hi Michael,

After reading this:

http://serverfault.com/questions/348967/openvpn-self-signed-certificate-in-chain-maybe-solved

I checked and found I had made the same mistake: the 'ca.crt' file that I was signing the request with was different from that of the server's. Ugh...what a horrible waste of time.

Thanks for the help; sorry to waste your time, too.

maikcat

hi there,

i also read others having similar problem and they used different ca.crt file
and i thought...naahhh...but never say never 8-)

glad to solved it out.

regards

michael.