VERIFY ERROR: depth=1, error=self signed certificate in cert

thedukeoffail

Hi there.

I previously had an OpenVPN setup on a server which was running very well - completely stable. I moved to a new server last night and accidentally forgot to transfer the OpenVPN settings before I closed down the old one. So, I have just gone ahead and re-installed and re-created all the keys etc that I'll need. However, I am just getting this:

Sat Jun 01 13:29:46 2013 OpenVPN 2.1_rc15 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Nov 19 2008
Sat Jun 01 13:29:46 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Jun 01 13:29:46 2013 LZO compression initialized
Sat Jun 01 13:29:46 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Jun 01 13:29:46 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Jun 01 13:29:46 2013 Local Options hash (VER=V4): '41690919'
Sat Jun 01 13:29:46 2013 Expected Remote Options hash (VER=V4): '530fdded'
Sat Jun 01 13:29:46 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Jun 01 13:29:46 2013 UDPv4 link local: [undef]
Sat Jun 01 13:29:46 2013 UDPv4 link remote: 192.34.60.218:1194
Sat Jun 01 13:29:46 2013 TLS: Initial packet from 192.34.60.218:1194, sid=bc4db408 c6a08710
Sat Jun 01 13:29:47 2013 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=UK/ST=England/L=London/O=The_Debonair/OU=changeme/CN=veda/name=veda/emailAddress=thedukeoffail@thedebonair.net
Sat Jun 01 13:29:47 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sat Jun 01 13:29:47 2013 TLS Error: TLS object -> incoming plaintext read error
Sat Jun 01 13:29:47 2013 TLS Error: TLS handshake failed
Sat Jun 01 13:29:47 2013 TCP/UDP: Closing socket
Sat Jun 01 13:29:47 2013 SIGUSR1[soft,tls-error] received, process restarting
Sat Jun 01 13:29:47 2013 Restart pause, 2 second(s)

Server: Ubuntu 12.04
Client: Windows 7 64bit with OpenVPN GUI

To do the setup I have followed these guides exactly (all are the same, essentially, and I have done this multiple times):
https://library.linode.com/networking/openvpn/debian-6-squeeze
https://help.ubuntu.com/12.04/serverguide/openvpn.html
https://www.digitalocean.com/community/articles/how-to-setup-and-configure-an-openvpn-server-on-debian-6
http://programster.blogspot.co.uk/2013/04/ubuntu-1204-set-up-openvpn-server.html

As best I can tell, I am not doing anything wrong. The ca.crt should be the same on both client and server. I tried doing openssl verify -CAfile ca.crt on the client but it just comes back with WARNING: can't open config file: /usr/local/ssl/openssl.cnf, and I can't find where the actual settings are supposed to be in OpenVPN GUI to set the path properly for that.

Nothing about my client-side has changed from yesterday when it worked with another server - I have just transferred over the new config files.

Any help would be appreciated. For whatever reason my internet at home is extremely unstable and the only way to get a lot of things to work is tunnel through the VPN (I have no idea why).

Thanks.

janjust

it seems the certificate for the client CN=veda is self-signed:

/C=UK/ST=England/L=London/O=The_Debonair/OU=changeme/CN=veda/name=veda/emailAddress=thedukeoffail@thedebonair.net

how did you generate this cert?

thedukeoffail

Veda is the server. I followed the tutorials linked in my post.

Something along the lines of this:

. /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/clean-all
. /etc/openvpn/easy-rsa/2.0/build-ca
./build-key-server veda

Then, to generate the client I did:

./build-key virtue

I transferred the CA and the client crt and key to my computer and placed them in the correct folder for OpenVPN GUI along with the client configuration. As far as I can tell I am following what I should be doing exactly 🙁

janjust

this sounds right...
what does

openssl verify -CAfile ca.crt veda.crt

give?

double check that the right ca.crt is addressed on the client and server (check the full paths).

thedukeoffail

That command gives and OK. I can't check the client-side because openssl refuses to run without a config file I don't seem to have. But checking the version of virtue.crt that's on the server gives an OK as well.

The configs and crts etc are all in the same folder and are spelled correctly.

janjust

can you send me the ca.crt, vena.crt and virtue.crt files? (or post them here, they're public anyway).

check the client configuration file as well, and check that the right version of ca.crt is installed on the client.