OpenVPN Certificates - unsupported server type

flanga

Hello,

we are running OpenVPN on CentOS 7.3 and issued certificates from our CA for both the server and the client. The Server certificates contain serverAuth in extendedKeyUsage and also server as nscerttype.

Nevertheless, my OpenVPN Client fails to connect to the server with the unsupported server error:

May 16 07:42:04: VERIFY ERROR: depth=0, error=unsupported certificate purpose: O=Flanga, OU=Organization Validated Control, CN=fl-rz1vpn2.flanga.io, L=Braunschweig, ST=Niedersachsen, C=DE
May 16 07:42:04: OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Server Certificate extensions:

        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Netscape Cert Type:
                SSL Server

User Certificate Extensions
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            Netscape Cert Type:
                SSL Client

Can somebody help me with this?

TinCanTech

Please post server and client config (remove private data)

flanga

Server Config:
local 172.16.198.1
port 18374
proto udp
dev tap
ca /etc/openvpn/ca.crt
cert /etc/openvpn/servercert.crt
key /etc/openvpn/servercert.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server-bridge
push "dhcp-option DNS 172.16.20.1"
push "dhcp-option DNS 172.16.20.3"
duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

Client Config is Viscosity on OSX:

server: vpn.example.com
port: 18374
Protocol: UDP
Device: TAP
Use DHCP: yes

Authentication SSL/TLS Client:
CA: ca.crt
Cert: cert.crt
key: key.key
tls-auth: ta.key (1)
Persist-tun
Persist-key
Require Server nsCertType yes (changing this did not help)
LZO-Compression off
no bind
pull options yes

TinCanTech

Which version(s) of openvpn are you using ?

flanga

OpenVPN Version 2.4.2-2.el7 from EPEL-7 Repository on CentOS 7.
Viscosity 1.6.8

TinCanTech

flanga wroteOpenVPN Version 2.4.2-2.el7 from EPEL-7 Repository on CentOS 7.

n the server ..

flanga wroteViscosity 1.6.8

on the client ..

maybe try tunnelblick on the client ?

flanga

Reissued the certificate and changed the keyUsage to digitalSignature, keyEncipherment, now it works..

Thank you for you help 🙂

TinCanTech

Thanks for letting us know 8-)