Hi. I know - this is common problem, but after spent few hours googling and reconfiguring doesn't help. I have one [b]OpenVPN[/b] server, under [b]CentOS[/b] 6.6. Three clients - two under CentOS, and one - under Windows 7 with OpenVPN GUI installed. I created all certs (for all clients) with same steps: [code]# cd /etc/openvpn/easy-rsa[/code] [code]# ./build-key setevoy_main Generating a 2048 bit RSA private key ............+++ ..................+++ writing new private key to 'setevoy_main.key' ... Country Name (2 letter code) [UA]: State or Province Name (full name) [None]: Locality Name (eg, city) [Kiev]: Organization Name (eg, company) [Venti private server]: Organizational Unit Name (eg, section) [Venti private server]: Common Name (eg, your name or your server's hostname) [setevoy_main]: Name [EasyRSA]: Email Address [root@setevoy.org.ua]: ... Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf ... Certificate is to be certified until Dec 14 13:46:24 2024 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated[/code] [code]# ls -l keys/ | grep main -rw-r--r-- 1 root root 5566 Dec 17 15:46 setevoy_main.crt -rw-r--r-- 1 root root 1110 Dec 17 15:46 setevoy_main.csr -rw------- 1 root root 1708 Dec 17 15:46 setevoy_main.key[/code] [code]# mkdir /etc/openvpn/clients/setevoy_main[/code] [code]# cp /etc/openvpn/easy-rsa/keys/setevoy_main.* /etc/openvpn/clients/setevoy_main[/code] [code]# cp /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/clients/setevoy_main/[/code] [code]# cp /usr/share/doc/openvpn-2.3.2/sample/sample-config-files/client.conf /etc/openvpn/clients/setevoy_main/client.ovpn[/code] Edit it: [code]# cat /etc/openvpn/clients/setevoy_main/client.ovpn client ;dev tap dev tun ;dev-node MyTap ;proto tcp proto udp remote 77.120.130.20 1194 ;remote my-server-2 1194 ;remote-random resolv-retry infinite nobind ;user nobody ;group nobody persist-key persist-tun ;http-proxy-retry ;http-proxy [proxy server] [proxy port ] ;mute-replay-warnings ca ca.crt cert setevoy_main.crt key setevoy_main.key ns-cert-type server ;tls-auth ta.key 1 ;cipher x comp-lzo verb 4 ;mute 20[/code] Then - copy to [b]Windows[/b] machine to [b]OpenVPN[/b] config directory (using [b]Cygwin[/b], so - output here in "console format"): [code]$ pwd /cygdrive/c/Program Files (x86)/OpenVPN/config[/code] [code]$ scp -r -P 2222 setevoy@setevoy.org.ua:/etc/openvpn/clients/setevoy_main/* . setevoy@setevoy.org.ua's password: ca.crt 100% 1850 1.8KB/s 00:00 client.ovpn 100% 433 0.4KB/s 00:00 setevoy_main.crt 100% 5566 5.4KB/s 00:00 setevoy_main.csr 100% 1110 1.1KB/s 00:00 setevoy_main.key 100% 1708 1.7KB/s 00:00[/code] [code]15:51:35 [setevoy@setevoy-main /cygdrive/c/Program Files (x86)/OpenVPN/config] $ ls -l итого 21 -rw-r--r--+ 1 setevoy None 1850 дек 17 15:51 ca.crt -rw-r--r--+ 1 setevoy None 433 дек 17 15:51 client.ovpn -rw-r--r--+ 1 setevoy None 5566 дек 17 15:51 setevoy_main.crt -rw-r--r--+ 1 setevoy None 1110 дек 17 15:51 setevoy_main.csr -rw-r--r--+ 1 setevoy None 1708 дек 17 15:51 setevoy_main.key[/code] Check [b]CA[/b] cert and client's cert: [code]$ ../bin/openssl.exe verify -CAfile ca.crt setevoy_main.crt setevoy_main.crt: OK[/code] But, when I start it - every time got error: [quote]Wed Dec 17 15:53:24 2014 us=641068 TLS: Initial packet from 77.120.103.20:1194, sid=e6e1a07d f581c685 Wed Dec 17 15:53:24 2014 us=667076 VERIFY ERROR: depth=1, error=certificate signature failure: /C=UA/ST=None/L=Kiev/O=Venti_private_server/OU=Venti_private_server/CN=venti.setevoy.org.ua/name=EasyRSA/emailAddress=root@setevoy.org.ua Wed Dec 17 15:53:24 2014 us=667148 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Wed Dec 17 15:53:24 2014 us=667157 TLS Error: TLS object -> incoming plaintext read error Wed Dec 17 15:53:24 2014 us=667163 TLS Error: TLS handshake failed Wed Dec 17 15:53:24 2014 us=667267 TCP/UDP: Closing socket[/quote] Once again - two other clients, under [b]CentOS[/b], works perfectly. What I missed with [b]Windows[/b] client? Thanks. P.S. I assume previously, that problem is in different [b]OpenSSL[/b] version - on server was 1.0.1, in [b]OpenVPN GUI[/b] - 0.9, so - I changed it with new installation, and now both are same. Server side: [code]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013[/code] Cleint's side: [code]15:52:56 [setevoy@setevoy-main /cygdrive/c/Program Files (x86)/OpenVPN/config] $ ../bin/openssl.exe version OpenSSL 1.0.1j 15 Oct 2014[/code]

OpenVPN GUI: VERIFY ERROR

setevoy

Hi.

I know - this is common problem, but after spent few hours googling and reconfiguring doesn't help.

I have one OpenVPN server, under CentOS 6.6.
Three clients - two under CentOS, and one - under Windows 7 with OpenVPN GUI installed.

I created all certs (for all clients) with same steps:

# cd /etc/openvpn/easy-rsa

# ./build-key setevoy_main
Generating a 2048 bit RSA private key
............+++
..................+++
writing new private key to 'setevoy_main.key'
...
Country Name (2 letter code) [UA]:
State or Province Name (full name) [None]:
Locality Name (eg, city) [Kiev]:
Organization Name (eg, company) [Venti private server]:
Organizational Unit Name (eg, section) [Venti private server]:
Common Name (eg, your name or your server's hostname) [setevoy_main]:
Name [EasyRSA]:
Email Address [root@setevoy.org.ua]:
...
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
...
Certificate is to be certified until Dec 14 13:46:24 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

# ls -l keys/ | grep main
-rw-r--r-- 1 root root 5566 Dec 17 15:46 setevoy_main.crt
-rw-r--r-- 1 root root 1110 Dec 17 15:46 setevoy_main.csr
-rw------- 1 root root 1708 Dec 17 15:46 setevoy_main.key

# mkdir /etc/openvpn/clients/setevoy_main

# cp /etc/openvpn/easy-rsa/keys/setevoy_main.* /etc/openvpn/clients/setevoy_main

# cp /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/clients/setevoy_main/

# cp /usr/share/doc/openvpn-2.3.2/sample/sample-config-files/client.conf /etc/openvpn/clients/setevoy_main/client.ovpn

Edit it:

# cat /etc/openvpn/clients/setevoy_main/client.ovpn
client
;dev tap
dev tun
;dev-node MyTap
;proto tcp
proto udp
remote 77.120.130.20 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry
;http-proxy [proxy server] [proxy port ]
;mute-replay-warnings
ca ca.crt
cert setevoy_main.crt
key setevoy_main.key
ns-cert-type server
;tls-auth ta.key 1
;cipher x
comp-lzo
verb 4
;mute 20

Then - copy to Windows machine to OpenVPN config directory (using Cygwin, so - output here in "console format"):

$ pwd
/cygdrive/c/Program Files (x86)/OpenVPN/config

$ scp -r -P 2222 setevoy@setevoy.org.ua:/etc/openvpn/clients/setevoy_main/* .
setevoy@setevoy.org.ua's password:
ca.crt         100% 1850     1.8KB/s   00:00
client.ovpn          100%  433     0.4KB/s   00:00
setevoy_main.crt        100% 5566     5.4KB/s   00:00
setevoy_main.csr        100% 1110     1.1KB/s   00:00
setevoy_main.key       100% 1708     1.7KB/s   00:00

15:51:35 [setevoy@setevoy-main /cygdrive/c/Program Files (x86)/OpenVPN/config] $ ls -l
итого 21
-rw-r--r--+ 1 setevoy None 1850 дек 17 15:51 ca.crt
-rw-r--r--+ 1 setevoy None  433 дек 17 15:51 client.ovpn
-rw-r--r--+ 1 setevoy None 5566 дек 17 15:51 setevoy_main.crt
-rw-r--r--+ 1 setevoy None 1110 дек 17 15:51 setevoy_main.csr
-rw-r--r--+ 1 setevoy None 1708 дек 17 15:51 setevoy_main.key

Check CA cert and client's cert:

$ ../bin/openssl.exe verify -CAfile ca.crt setevoy_main.crt
setevoy_main.crt: OK

But, when I start it - every time got error:

Wed Dec 17 15:53:24 2014 us=641068 TLS: Initial packet from 77.120.103.20:1194, sid=e6e1a07d f581c685
Wed Dec 17 15:53:24 2014 us=667076 VERIFY ERROR: depth=1, error=certificate signature failure: /C=UA/ST=None/L=Kiev/O=Venti_private_server/OU=Venti_private_server/CN=venti.setevoy.org.ua/name=EasyRSA/emailAddress=root@setevoy.org.ua
Wed Dec 17 15:53:24 2014 us=667148 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Dec 17 15:53:24 2014 us=667157 TLS Error: TLS object -> incoming plaintext read error
Wed Dec 17 15:53:24 2014 us=667163 TLS Error: TLS handshake failed
Wed Dec 17 15:53:24 2014 us=667267 TCP/UDP: Closing socket

Once again - two other clients, under CentOS, works perfectly.

What I missed with Windows client?

Thanks.

P.S. I assume previously, that problem is in different OpenSSL version - on server was 1.0.1, in OpenVPN GUI - 0.9, so - I changed it with new installation, and now both are same.

Server side:

# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

Cleint's side:

15:52:56 [setevoy@setevoy-main /cygdrive/c/Program Files (x86)/OpenVPN/config] $ ../bin/openssl.exe version
OpenSSL 1.0.1j 15 Oct 2014

[deleted]

Set an absolute path to the certificates. That should straighten you out.