Error setting up OpenVPN server

Amornik

Hello,

Ive been trying to figure this thing out and searching both the forums and the internet, no luck..

i'm trying to setup the OpenVPN server on my netgear R7000 (with Shibby) and once I finish creating and pasting the varoius certificates and keys, when trying to start the server I get this:

Cannot load private key file server.key: error:0B080074:lib(11):func(128):reason(116)
Error: private key password verification failed

Now..I have created and re-created the certs and keys several times without a password or challenge.

I have no idea why this error keeps popping.
I even tried to decode the key file (that doesn't have a password!) with: openssl rsa -in http://www.key -out new.key

nothing.

any ideas?

thanks!

Amornik

No one knows ?!...

🙁

Traffic

Amornik wroteError: private key password verification failed

Amornik wroteNow..I have created and re-created the certs and keys several times without a password or challenge

It looks like you have not done that right ..

Amornik

you are a prophet!
Indeed, I also figured Something is not right, and that's why I'm here. to see if someone has seen this before.
going over forum post after another, there is no apparent solution to this..
Simply writing "you have not done it right" really helped, thanks! :geek:

Traffic

So you worked out what you did wrong ?

Amornik

Sadly no. I have gone over the openvpn guide again step by step. I'm creating the key without a password. I cannot understand this.

is there another way to do this besides openssl/easyRSA ?

Traffic

Amornik wroteI'm creating the key without a password

what command do you use to do this ?

Amornik

the command is "build-key-server server" from the easyrsa directory.

see what i found (even though i tried this no luck. it doesn't ask me for a password when converting meaning there was not one assign to begin with?)

Removing a password from server key

This is the only tricky part. Now that you have almost all the files that you need, you could try uploading them to a proper section in Tomato VPN settings and running a server. Unfortunately you will end up with following (or similar) message:

daemon.warn openvpn[2263]: NOTE: OpenVPN 2.1 requires '--script-security 2' or \
higher to call user-defined scripts or executables
daemon.notice openvpn[2263]: Diffie-Hellman initialized with 2048 bit key
daemon.warn openvpn[2263]: WARNING: this configuration may cache passwords \
in memory -- use the auth-nocache option to prevent this
daemon.warn openvpn[2263]: Cannot load private key file server.key: \
error:0907B068:lib(9):func(123):reason(104): error:140B0009:lib(20):func(176):reason(9)
daemon.err openvpn[2263]: Error: private key password verification failed
daemon.notice openvpn[2263]: Exiting
It’s because you’ve uploaded a key that is password protected and you don’t have a input box or any other place where you could provide this password. On the other hand, you can’t generate a server key and server certificate without a password. Leaving it blank will cause a following error:

UI_set_result:result too small:ui_lib.c:869:You must type in 4 to 1024 characters
PEM routines:PEM_def_callback:problems getting password:pem_lib.c:111:
PEM routines:DO_PK8PKEY:read key:pem_pk8.c:130:

Easy-RSA error:

Failed to generate request
So now, you need to generate new key that doesn’t require a password, based on the server key you already have:

cd pki/private
openssl rsa -in SERVERNAME.key -out SERVERNAME_nopass.key
Enter pass phrase for SERVERNAME.key: SERVER KEY PASSWORD
writing RSA key

Traffic

Amornik wrotethe command is "build-key-server server" from the easyrsa directory.

With easyrsa use this command:

build-key-server server-name nopass

Amornik

Hi,

I don't know what happened, but I didnt change anything and suddenly non of the easy-rsa commands work.
they all present the options as if the syntax is wrong.

I didn't change or uninstall anything. how odd !

re-installed openVPN and openSSL, still says the syntax is wrong and won't let me run build.ca or build-key-server

any ideas?

EDIT:

trying the manual commands getting an error:

C:\Program Files\OpenVPN\easy-rsa\Keys>openssl
WARNING: can't open config file: /etc/ssl/openssl.cnf
OpenSSL> req -new -config ca.cnf -keyout ca.key -out ca.req
error on line -1 of ca.cnf
4600:error:02001002:system library:fopen:No such file or directory:bss_file.c:175:fopen('ca.cnf','rb')
4600:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:178:
4600:error:0E078072:configuration file routines:DEF_LOAD:no such file:conf_def.c:195:
error in req

Amornik

Allright, made a slight mess 🙂

am now following the guide in : http://www.macfreek.nl/memory/Create_a_OpenVPN_Certificate_Authority#Build_CA_certificate

according to it i'm trying to build the ca certificate with the following error:

C:\Program Files\OpenVPN\easy-rsa\Keys\ca>openssl
WARNING: can't open config file: /etc/ssl/openssl.cnf
OpenSSL> ca -config ca-sign.cnf -extensions X509_ca -days 3650 -create_serial -selfsign -keyfile ca.key -in ca.req -out ca.crt
Using configuration from ca-sign.cnf
Loading 'screen' into random state - done
I am unable to access the /ca/ directory
/ca/: No such file or directory
unable to write 'random state'
error in ca
OpenSSL>

in the ca-sign.cfg file this is the line:

dir = /ca # Where everything is kept

should it look different? where should it point to?

thanks for the help!