Unable to start OpenVPN Server

beaksdale

Hi,
I'm trying to configure an OpenVPN server in bridge mode (for gaming) on my Asus N66u running AsusWRT (also had the same problem with DD-WRT) but I am unable to get it started. I checked the log and found this in the log:

daemon.err openvpn[1305]: neither stdin nor stderr are a tty device and you have neither a controlling tty nor systemd - can't ask for 'Enter Private Key Password:'. If you used --daemon, you need to use --askpass to make passphrase-protected ke

I have found a few examples of this error before online in older versions of OpenVPN (2.3.8) which they fixed by reverting to 2.3.7 but was then patched so not sure what to do.
Thanks

Traffic

It appears your server certificate has been password protected .. How do you create these files ?

beaksdale

Thanks for replying, I made them using the instructions provided in the readme for EasyRSA and then copied the text from the certificates onto to the routers configuration pages as instructed in a OpenVPN router guide. I was asked to set passphrases for the keys and set them but nothing else

Traffic

beaksdale wroteI made them using the instructions provided in the readme for EasyRSA

Using EasyRSA protects certificates with a password by default.

The easiest solution for you would be to recreate your server and client certs with the nopass option.

beaksdale

That fixed it I've got the server running now thank you (sorry for the slow reply my internet was down for most of last week) though I can't get clients to connect, I get this error:

Sun May 08 13:02:32 2016 VERIFY nsCertType ERROR: CN=n66, require nsCertType=SERVER
Sun May 08 13:02:32 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sun May 08 13:02:32 2016 TLS Error: TLS object -> incoming plaintext read error
Sun May 08 13:02:32 2016 TLS Error: TLS handshake failed

I tried searching for the error but the only answer I could find was to rebuild the certificates & keys which I did but with no success.

Traffic

beaksdale wroteVERIFY nsCertType ERROR: CN=n66, require nsCertType=SERVER

By default, EasyRSA no longer uses nsCertType .. so --ns-cert-type server should not be used in the client config.

Instead, if you use EasyRSA.3x for your PKI then use --remote-cert-tls server in your client config.

See --remote-cert-tls in The Manual v23x

Also, see vars.example from EasyRSA.3x