Server certificate expired - certificate verify expired

intane

Hi,

we current have a problem with our OpenVPN conncetivity.

Two days ago the ca.crt along with server.crt, server.key and server.csr expired.

We are using WinServer 2008r2 with Windows clients.

A new ca.crt and server.crt was built, ca.crt without pw but server.crt with pw.

I replaced the ca.crt in the server folder where server.ovpn config is telling me to.

I also replaced the ca.crt on my local client but unfortunatly without success.

The commands I use were build-ca and build-key-pass for the server.crt, and before them the command vars.bat.

Should I build the server certificate without password?
What is the command for that?

The error I get is:

VERIFY ERROR: depth=0, error=unable to get local issuer certificate: ...
OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed.

Can I somehow verify the new certificates?

thank a lot

intane

TinCanTech

intane wroteA new ca.crt and server.crt was built

You will have to build and replace all your clients certificates as well.

intane wroteShould I build the server certificate without password?
What is the command for that?

Add nopass to the commands.

intane

"You will have to build and replace all your clients certificates as well"

Yes Iam aware of that, I just replaced at first only mine for the test reasons.

I added the command you told me, so "build-key server -nopass" works for the start but the question for a pem phrase comes again and if I left i blank an error occurs.

TinCanTech

intane wroteso "build-key server -nopass" works

Wrong.

build-key-server server.name nopass

intane wrotethe question for a pem phrase comes again and if I left i blank an error occurs.

Leave the pem passphrase blank. The error is probably due to something else.

Best advice, start from scratch.

intane

build-key-server occurs the same error.

The error that occurs is TXT_DB error number 2.
*old.old could not be found.

Start from the scratch would be too much work unfortunatly :/

So I search a way to create new server certificates.

TinCanTech

intane wroteTwo days ago the ca.crt along with server.crt, server.key and server.csr expired

intane wroteStart from the scratch would be too much work

I do not believe you have a choice ..

You are welcome to scour the internet and try to find a solution, if you prefer ..

intane

I want to search a little bit more before I do everything from the beginning.