I'm trying to setup OpenVPN using a wildcard certificate signed by GoDaddy for the CA instead of building a self-signed CA. There are many examples on the web of setting up OpenVPN using a self-signed CA but the only example I could find using an existing CA is
http://www.linuxlasse.net/linux/howtos/OpenVPN. Following that guide, I place my signed wildcard cert and key in the keys directory as ca.crt and ca.key, respectively. I verified they match using:
openssl x509 -noout -modulus -in ca.crt | openssl md5
and
openssl rsa -noout -modulus -in ca.key | openssl md5
Then I ran "./build-key-server server" but I cannot verify the server.crt file it creates with my ca.crt.
openssl verify -CAfile keys/ca.crt keys/server.crt
keys/server.crt: C = US, ST = VA, L = city, O = company, OU = VPN, CN = server
error 20 at 0 depth lookup:unable to get local issuer certificate
Not surprisingly, I cannot connect a client. When I attempt to do so I get these errors:
VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=VA/L=city/O=company/OU=VPN/CN=server
TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
TCP/UDP: Closing socket
When I use ./build-ca to generate a self-signed cert then I can verify the server.crt using ca.crt of course.
Am I missing something? I have read forum posts of other people using 3rd party signed certs for OpenVPN and the instructions on linuxlasse.net suggest it should be as simple as placing my ca.crt and ca.key the keys directory like I am doing. So why can I not verify my server.crt?
