Hi,
on a FreeBSD 11 box with most recent patch level, OpenVPN will not load the system-wide root CA file:
Fri Mar 24 00:07:01 2017 us=509997 OpenVPN 2.4.0 amd64-portbld-freebsd11.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jan 3 2017
Fri Mar 24 00:07:01 2017 us=510158 library versions: OpenSSL 1.0.2k-freebsd 26 Jan 2017, LZO 2.09
Fri Mar 24 00:07:01 2017 us=515232 Diffie-Hellman initialized with 4096 bit key
Fri Mar 24 00:07:01 2017 us=600275 Cannot load CA certificate file /usr/local/share/certs/ca-root-nss.crt (entry 129 did not validate)
Fri Mar 24 00:07:01 2017 us=611315 Cannot load CA certificate file /usr/local/share/certs/ca-root-nss.crt (only 171 of 172 entries were valid X509 names)
Fri Mar 24 00:07:01 2017 us=611435 Exiting due to fatal error
My aspiration is to setup OpenVPN in full TLS mode according to
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage#lbBF
Certificate issuer is Let's Encrypt. TLS setup works fine with e.g. nginx on the same box. The TLS config details for OpenVPN are these:
tls-server
ca /usr/local/share/certs/ca-root-nss.crt
cert /var/lib/acme/live/<hostname>/fullchain
key /var/lib/acme/live/<hostname>/privkey
dh /usr/local/etc/openvpn/tls/dh4096.pem
The root CA file is the most recent one. For sanity checks I rolled the related package back a few steps (2 or 3 months on FreeBSD's schedule) but that didn't help. Same error, different numbers in error messages.
What's wrong here? Any help much appreciated.
