I am trying to setup openvpn using certificates issued from my CA, running on Windows 2012.
I have a chain of certificates, whit the following hierarchy:
Root CA - jbd-root.pem
+--------- Subordinate CA - jbd-sub-01.pem
+---------------- Server Certificate - xxam-ne0007.pem
+---------------- Client Certificate - brdf-ne0005.pem
According to the documentation in wiki
https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains, I was supposed to use my root certificate in attribute "ca", and in attribute "cert", the chain of the machine certificate + the subordinate ca certificate.
In the server:
cat xxam-ne0007.pem jbd-sub-01.pem > xxam-ne0007-chain.pem
ca=jbd-root.pem
cert=xxam-ne0007-chain.pem
key=xxam-ne0007.key
In the client:
cat brdf-ne0005.pem jbd-sub-01.pem > brdf-ne0005-chain.pem
ca=jbd-root.pem
cert=brdf-ne0005-chain.pem
key=brdf-ne0005.key
When I follow these instructions, I get a commit error showing the certificate is not valid, in both client and server.
If I use the single files, without the chain, the config commits, but openvpn cannot find the issuer certificate.
All my certificate where converted to pem format, and Linux line breaks.
How can I instruct openvpn to find the correct certificate chain? Almost all samples uses self-signed certificates.
