i try to get my OpenVPN connection to work with the client opetion "remote-cert-tls server", but it shows the client shows:
....
Validating certificate key usage
++ Certificate has key usage 00e0, expects 00a0
++ Certificate has key usage 00e0, expects 0088
VERIFY KU ERROR
TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
SIGUSR1[soft,tls-error] received, process restarting
The Server config is following:
port 1194
proto udp
dev tun
persist-key
persist-tun
pkcs12 server-config.p12
dh dh2048.pem
server 192.168.12.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 30 180
push "keepalive 30 180"
comp-lzo
status server.log
verb 3
The client config looks like this:
client
resolv-retry infinite
remote localhost 1194
proto udp
dev tun
nobind
persist-key
persist-tun
pkcs12 OpenVPN_Client.p12
remote-cert-tls server
ns-cert-type server
redirect-gateway
mssfix
tun-mtu 1500
comp-lzo
verb 3
mute-replay-warnings
mute 20
Are there any problems with a pkcs12-file?
Do I have to use some special flags during the creation of the certificates? (I use xca to manage them).
Thanks
