how to update server certs w/o affecting existing clients

maniac

Some of the variables in my vars file is a few years old, such as my domains, emails, and I want to update everything to reflect everything current. I updated the ca, stacked them and new and old users connect fine. But when I update the servers certs using ./build-key-server server im unable to connect. I tried revoking the server cert and recreating but my clients cant connect. I also tried creating a different server cert filename, but that wont work too. Any advice on how to update my server certs without existing old users and having to reissue new certs? Its really a minor issue to have to update my certs variables, but it does contain old emails and such that I dont have access to anymore.

logs with just a revoked server cert using ./revoke-full server, and ./build-key-server server and building off my new ca and vars file. my server.conf contains the stacked ca.

client side

Thu Oct 10 15:21:48 2013 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=CA/L=UpdatedL/O=UpdatedO/OU=updated@email.com/CN=server/name=updated/emailAddress=updated@email.com
Thu Oct 10 15:21:48 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Thu Oct 10 15:21:48 2013 TLS Error: TLS object -> incoming plaintext read error
Thu Oct 10 15:21:48 2013 TLS Error: TLS handshake failed

 50.178.39.114:1194 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 10 16:21:39 2013 192.168.100.10:1194 TLS Error: TLS handshake failed
Thu Oct 10 16:21:39 2013 192.168.100.10:1194 SIGUSR1[soft,tls-error] received, client-instance restarting
Thu Oct 10 16:21:48 2013 MULTI: multi_create_instance called
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 Re-using SSL/TLS context
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 LZO compression initialized
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 Local Options hash (VER=V4): 'a2e63101'
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 Expected Remote Options hash (VER=V4): '272f1b58'
Thu Oct 10 16:21:48 2013 192.168.100.10:1194 TLS: Initial packet from [AF_INET]50.178.39.114:1194, sid=664f7e82 9fd3a490
Thu Oct 10 16:21:48 2013 read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
Thu Oct 10 16:21:50 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 10 16:21:51 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

maniac

My server config does point to the new server.crt server.key. i did sign the new sever cert using build-key-server and it's in the database. I even created a new user with the new ca and server cert/keys but get the same error. Not sure what im doing wrong. Well spend more time on it today

maniac

Thanks for replying to my thread Debbie. I provide my clients just called.crt client.crt client.key client.conf client.ovpn What do you mean by distributing the server cert?

Logs are in my previous post

Here server.conf

port 1194
proto udp
reneg-sec 0
dev tun
ca stacked.pem
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
cipher AES-128-CBC   # AES
comp-lzo
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log         /var/log/openvpn.log
log-append  /var/log/openvpn.log
verb 3

maniac

Oh gotcha.

But What variable do I use for the server.crt for clients .conf or .ovpn since cert is used for their own .crt file