I've got a problem at connection time. AFAICS the certificate chain is verified correctly, but then openVPN fails with [code] VERIFY FAIL -- bad X509 key usage in leaf certificate Transport Error: PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed EVENT: CERT_VERIFY_FAIL PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed [ERR] EVENT: DISCONNECTED [/code] The X509v3 extensions of my certificate are [code] X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: critical Digital Signature, Key Encipherment, Data Encipherment, Key Agreement X509v3 Extended Key Usage: TLS Web Client Authentication Netscape Comment: xca certificate [/code] On Linux this works fine, so every helpful comment is highly appreciated. The openVPN app is version 1.0.2.

This error normally occurs when you are using the [b]remote-cert-ku[/b] directive to force additional server certificate checks on the client, and those checks are failing. James

bad X509 key usage in leaf certificate

harri

I've got a problem at connection time. AFAICS the certificate chain is verified correctly, but then openVPN fails with

VERIFY FAIL -- bad X509 key usage in leaf certificate
Transport Error: PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
EVENT: CERT_VERIFY_FAIL PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed [ERR]
EVENT: DISCONNECTED

The X509v3 extensions of my certificate are

X509v3 Basic Constraints: critical
    CA:FALSE
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment, Data Encipherment, Key Agreement
X509v3 Extended Key Usage: 
    TLS Web Client Authentication
Netscape Comment: 
    xca certificate

On Linux this works fine, so every helpful comment is highly appreciated.
The openVPN app is version 1.0.2.

jamesyonan

This error normally occurs when you are using the remote-cert-ku directive to force additional server certificate checks on the client, and those checks are failing.

James

harri

Problem solved. :-)
Thanx very much
Harri

jongyau

Can you provide more information about how to solve the problem?
Many thanks!