Does anyone have a working configuration using Elliptic Curve certificates in the OpenVPN deployment?
I am using OpenVPN 2.3.2 with OpenSSL 1.0.1e.
Here are the following commands I used to create the certificates.
*CA*
> openssl ecparam -genkey -name secp384r1 -text -conv_form compressed -out cakey_tmp.pem
> openssl ec -in cakey_tmp.pem -out cakey.pem -aes256
> openssl req -new -x509 -key private/cakey.pem -config ../openssl.cnf -extensions v3_ca -subj '/C=US/ST=LA/L=Bakersfield/CN=CA/O=CA/emailAddress=CA@blah.com' -days 36500 -sha512 -out cacert.pem
*Server*
> openssl ecparam -genkey -name secp384r1 -text -conv_form compressed -out serverkey.pem
> openssl req -new -key private/serverkey.pem -config ../openssl.cnf -extensions server -subj '/C=US/ST=LA/L=Bakersfield/CN=Server/O=Server' -days 36500 -sha512 -out req.pem
> openssl ca -config ../openssl.cnf -extensions server -policy policy_anything -out ../server/servercert.pem -md sha512 -cert cacert.pem -keyfile private/cakey.pem -infiles req.pem
*Client*
> openssl ecparam -genkey -name secp384r1 -text -conv_form compressed -out clientkey_temp.pem
> openssl ec -in clientkey_temp.pem -out clientkey.pem -aes256
> openssl req -new -key private/clientkey.pem -config ../openssl.cnf -extensions client -subj '/C=US/ST=CA/L=Bakersfield/CN=Client1/O=Client1/emailAddress=client1@blah.com' -days 36500 -sha512 -out req.pem
> openssl ca -config ../openssl.cnf -policy policy_anything -extensions client -out ../client/clientcert.pem -md sha512 -cert cacert.pem -keyfile private/cakey.pem -infiles req.pem
*Server.conf*
local xx.xx.xx.xx
port 1194
proto udp
dev tun
server yy.yy.yy.0 255.255.255.0
ca ./cacert.pem
cert ./servercert.pem
key ./private/serverkey.pem
dh ./dh.pem
auth SHA512
cipher AES-256-CBC
push route yy.yy.yy.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
*client.conf*
client
remote xx.xx.xx.xx 1194
dev tun
proto udp
nobind
ca ./cacert.pem
cert ./clientcert.pem
key ./private/clientkey.pem
cipher AES-256-CBC
auth SHA512
ns-cert-type server
comp-lzo
script-security 2
persist-key
persist-tun
mute-replay-warnings
verb 3
mute 5
When my client tries to connect it hangs during the TLS handshake phase.
On my client, the logs state:
- TLS key negotiation failed to occue within 60 seconds
- TLS handshake failed
Any ideas what could be wrong?
