Impossible to create new client certificates

gcp900

Hello!

I have an openvpn server running without problems on a raspberry pi. The server works fine and the certificates that I created when I set up the server work properly. The problem comes when I try to create new certificates. Apparently the certificates are created correctly but when I try to use them it is impossible to connect and in the log appears "CA=false" (for certificates that work appears CA=true). The procedure and the output console is the following:

pi@raspberrypi /etc/openvpn/easy-rsa/keys $ cd /etc/openvpn/easy-rsa

pi@raspberrypi /etc/openvpn/easy-rsa $ source vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

pi@raspberrypi /etc/openvpn/easy-rsa $ ./build-key *******
Generating a 2048 bit RSA private key
....................+++
..................+++
writing new private key to '********.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [******]:
State or Province Name (full name) [****]:
Locality Name (eg, city) [*******]:
Organization Name (eg, company) [******]:
Organizational Unit Name (eg, section) [******]:
Common Name (eg, your name or your server's hostname) [******]:
Name [EasyRSA]:
Email Address [***************]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'**'
stateOrProvinceName   :PRINTABLE:'**'
localityName          :PRINTABLE:'*********'
organizationName      :PRINTABLE:'*********'
organizationalUnitName:PRINTABLE:'********'
commonName            :PRINTABLE:'********'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'***************'
Certificate is to be certified until Sep 17 08:07:40 2025 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Where you can see asterisks it is only for privacity, the values are left by default.

What am I doing wrong? Any idea to look for?

Traffic

You have successfully created a new client key and certificate.

Please post your server and client configs and logs.

gcp900

Here is the connection log from linux using the new certificates. Asterisk are again just for privacity. I have left the log until I had two connection attempts for showing the errors. The ca.crt file is the same for every client. The same computer with the same ca.crt and the certificates created at the beginning connects without problem.

Fri Sep 25 10:33:01 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Fri Sep 25 10:33:01 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Sep 25 10:33:01 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Fri Sep 25 10:33:02 2015 UDPv4 link local: [undef]
Fri Sep 25 10:33:02 2015 UDPv4 link remote: [AF_INET]**.***.**.***:1194
Fri Sep 25 10:33:02 2015 TLS: Initial packet from [AF_INET]**.***.**.***:1194, sid=58d9b52f f163ccfe
Fri Sep 25 10:33:02 2015 VERIFY OK: depth=1, C=SP, ST=MU, L=******, O=******, OU=******, CN=****** CA, name=EasyRSA, emailAddress=****************
Fri Sep 25 10:33:02 2015 VERIFY OK: depth=0, C=SP, ST=MU, L=******, O=******, OU=******, CN=server, name=EasyRSA, emailAddress=****************
Fri Sep 25 10:34:02 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Sep 25 10:34:02 2015 TLS Error: TLS handshake failed
Fri Sep 25 10:34:02 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Sep 25 10:34:02 2015 Restart pause, 2 second(s)
Fri Sep 25 10:34:04 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Sep 25 10:34:04 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Fri Sep 25 10:34:04 2015 UDPv4 link local: [undef]
Fri Sep 25 10:34:04 2015 UDPv4 link remote: [AF_INET]**.***.**.***:1194
Fri Sep 25 10:34:05 2015 TLS: Initial packet from [AF_INET]**.***.**.***:1194, sid=233e0145 80739e7b
Fri Sep 25 10:34:05 2015 VERIFY OK: depth=1, C=SP, ST=MU, L=******, O=******, OU=******, CN=****** CA, name=EasyRSA, emailAddress=****************
Fri Sep 25 10:34:05 2015 VERIFY OK: depth=0, C=SP, ST=MU, L=******, O=******, OU=******, CN=server, name=EasyRSA, emailAddress=****************

This is the server log

Sep 25 10:33:02 raspberrypi ovpn-server[2201]: MULTI: multi_create_instance called
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 Re-using SSL/TLS context
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 LZO compression initialized
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 Local Options hash (VER=V4): '530fdded'
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 Expected Remote Options hash (VER=V4): '41690919'
Sep 25 10:33:02 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 TLS: Initial packet from [AF_INET]155.54.213.67:34986, sid=56dbc7f2 030c$
Sep 25 10:33:03 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=$
Sep 25 10:33:03 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routine$
Sep 25 10:33:03 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 TLS Error: TLS object -> incoming plaintext read error
Sep 25 10:33:03 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 TLS Error: TLS handshake failed
Sep 25 10:33:03 raspberrypi ovpn-server[2201]: 155.54.213.67:34986 SIGUSR1[soft,tls-error] received, client-instance restarting
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: MULTI: multi_create_instance called
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 Re-using SSL/TLS context
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 LZO compression initialized
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 Local Options hash (VER=V4): '530fdded'
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 Expected Remote Options hash (VER=V4): '41690919'
Sep 25 10:34:05 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 TLS: Initial packet from [AF_INET]155.54.213.67:29768, sid=544f40fe 71ad$
Sep 25 10:34:06 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=$
Sep 25 10:34:06 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routine$
Sep 25 10:34:06 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 TLS Error: TLS object -> incoming plaintext read error
Sep 25 10:34:06 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 TLS Error: TLS handshake failed
Sep 25 10:34:06 raspberrypi ovpn-server[2201]: 155.54.213.67:29768 SIGUSR1[soft,tls-error] received, client-instance restarting
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: MULTI: multi_create_instance called
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Re-using SSL/TLS context
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 LZO compression initialized
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Local Options hash (VER=V4): '530fdded'
Sep 25 10:44:39 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 TLS: Initial packet from [AF_INET]155.54.213.67:44484, sid=e22ccb78 8a35$
Sep 25 10:44:40 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 VERIFY OK: depth=1, /C=SP/ST=MU/L=******/O=******/OU=******/CN=*****_CA$
Sep 25 10:44:40 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 VERIFY OK: depth=0, /C=SP/ST=MU/L=******/O=******/OU=******CN=******/n$
Sep 25 10:44:41 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 25 10:44:41 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authent$
Sep 25 10:44:41 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 25 10:44:41 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authent$
Sep 25 10:44:41 raspberrypi ovpn-server[2201]: 155.54.213.67:44484 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit $

Can you see anything??

Traffic

Perhaps you have not signed the cert with the correct CA:
https://forums.openvpn.net/topic10828.html

gcp900

This is what I have figured out:

If I try to verify the certifies with the command

openssl verify -CAfile <path-to-yourCA.crt> <client.crt>

I get OK for the old certifies and an

error 20 at 0 depth lookup:unable to get local issuer certificate

for new certifies. I have to emphasize that there are two ca.crt files, one in the openvpn directory and the other one in the /openvpn/easy-rsa/keys directory, where we can find the files created for clients. If I used the verify command with the ca.crt file stored in the keys directory the verify for new created clients is OK!! but not for old clients!!. What it seems that is happening is that the ca.crt used for the openvpn server is different from the ca.crt used for creating new clients. I have not done anything with those ca.crt file since I created the openvpn server and the first client files, so I don't know why they are different. Is it normal? I can't use the ca.crt file from server to create new certifies because in the keys directory there is also a ca.key file that is incompatible with the ca.crt from server so if I try to exchange the ca.crt files I get an error when I try to create new client certificates.

This is a mess!! What's happening here? Can you explain me why there are two ca.crt files and why they are different? It was an error when I created the server??

Thanks a lot!!

Traffic

gcp900 wroteIt was an error when I created the server??

If your description is accurate then it sounds like you have used two different CAs to sign your clients ..

I would work out which one is the correct ca.crt/key and remove (to backup) the other one and then create new client.crt/key(s) from the correct CA.

Worse case scenario: Recreate your entire PKI from scratch !

These things can happen if you are not careful ...

Traffic

Here are two pages which may help you out.

This shows how you can create a really secure PKI:
https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto

You could also use it to create new client cert/key pairs with signing requests.

This is the easy way and not really recommended:
https://community.openvpn.net/openvpn/wiki/EasyRSA3-Insecure-PKI

Bear in mind:
You could run two server instances temporarily but that may be more hassle than it is worth.

gcp900

Thanks for your responses 😉

Actually the correct ca.crt is the one which is in the openvpn directory. I know it because if I change the ca.crt for the other which is in the keys directory the openvpn server doesn't work for any client. Once we know it, the solution would be as simple as changing the ca.crt from openvpn directory to keys directory, the problem is that the ca.key file which is necessary for creating new clients doesn't match the ca.crt file. is it possible to create a new ca.key file that match the ca.crt file?

Thanks

Traffic

gcp900 wrotethe problem is that the ca.key file which is necessary for creating new clients doesn't match the ca.crt file.

It is likely that you have moved your ca.key to a secure medium, as is recommended .. perhaps you have moved it to a flash drive ..

gcp900 wrote is it possible to create a new ca.key file that match the ca.crt file?

If it were possible then there would be no internet security at all .. so NO. :ugeek: