I don't know where to post this, it could be server or certificates... I'll try here.
I have two different openvpn servers (two different machines):
- serverA and serverB have the same ca, server and client certificates, but differ in the configuration
- serverA requires ldap auth and uses client configuration directives (ccd), while serverB just needs valid certificates
now, on my linux pc I have two client configs, one for serverA and one for serverB
suddenly, I can't be authenticated against serverA because (some user/mail/domain detail edited below):
-------------------------------------
Mon Dec 12 17:54:56 2016 192.168.x.y:54116 VERIFY ERROR: depth=0, error=certificate has expired: /C=IT/ST=IT/L=Torino/O=doma.in/CN=client_myname/name=myname/emailAddress=
myemail@doma.in
-------------------------------------
but I can still connect to serverB! And it show a similar line but with " VERIFY OK: depth=0,"
Now, I've checked this on both servers: "openssl x509 -in keys/clients/client_myname.crt -noout -enddate"
and on both I get the same output:"notAfter=Oct 6 14:16:05 2019 GMT"
since system date now is "Mon Dec 12 18:17:53 CET 2016" it should be still valid, I think.
I tried -fingerprint and I get the same exact output, for ca.crt, server.crt and client.crt files compared from both servers.
and, obviously on my client: same fingerprint for ca.crt and client.crt here also, and the same certificates are used for both openvpn client profiles...
I don't think ldap is involved, because the log shows that handshake fails even before getting there...
then I also printed the full -text option output for both certificates (client and ca on both servers) and compared with a diff tool (meld) and they show no differences...
What could it be? How can I discover why this cert is evaluated as expired, while it's good?
Marco
