I am trying to set up an OpenVPN server on a brand new RPi3B with Raspbian Stretch from the Sept 2017 image. I have performed all the usual steps using apt-get to install openvpn and it got me version 2.4.0 Previous installations I have done on Raspbian Wheezy ended up with 2.1.xx. On 2.4.0 easy-rsa is part of the install but is hidden in /usr/share/easy-rsa, so I copied it to /etc/openvpn/easy-rsa Now I have edited the vars script and it seemed satisfied after I replaced the double quotes in these lines: [code]export EASY_RSA="/etc/openvpn/easy-rsa" export KEY_CONFIG="$EASY_RSA/whichopensslcnf $EASY_RSA"[/code] But when I run the command ./build-ca I get this displayed: [code]root@rpi3-vpn:/etc/openvpn/easy-rsa# ./build-ca grep: /etc/openvpn/easy-rsa/whichopensslcnf /etc/openvpn/easy-rsa: No such file or directory pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong version of openssl.cnf: /etc/openvpn/easy-rsa/whichopensslcnf /etc/openvpn/easy-rsa The correct version should have a comment that says: easy-rsa version 2.x [/code] What does this mean and what can I do to fix it? I checked the openssl version: [code]root@rpi3-vpn:/etc/openvpn/easy-rsa# openssl version OpenSSL 1.1.0f 25 May 2017 [/code] And in the easy-rsa dir there are the following sample openssl.cnf files: [code]-rw-r--r-- 1 root root 7859 Jul 13 2015 openssl-0.9.6.cnf -rw-r--r-- 1 root root 8416 Jul 13 2015 openssl-0.9.8.cnf -rw-r--r-- 1 root root 8313 Jul 13 2015 openssl-1.0.0.cnf[/code] If I look at the openssl-1.0.0.cnf file the very first line is this comment: [code]# For use with easy-rsa version 2.0 and OpenSSL 1.0.0* [/code]So it does in fact mention easy-rsa 2.0... In earlier installations I did not touch the KEY_CONFIG line so it looked like this by default: [code]export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`[/code] But if I go back to those quotes I get this error message: [code]root@rpi3-vpn:/etc/openvpn/easy-rsa# source ./vars ************************************************************** No /etc/openvpn/easy-rsa/openssl.cnf file could be found Further invocations will fail ************************************************************** [/code] I am really at a loss here, since no howto I find on the net for OpenVPN on Raspbian Stretch seems to work. Can someone please advice as to why the openssl is not correctly configured in this case? And of course tell me what to do to fix it.... Should I just replace the use of whichopensslcnf with this line: [code]export KEY_CONFIG="$EASY_RSA/openssl-1.0.0.cnf $EASY_RSA"[/code] But of course it did not cut it: [code]root@rpi3-vpn:/etc/openvpn/easy-rsa# source ./vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys root@rpi3-vpn:/etc/openvpn/easy-rsa# ./build-ca grep: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa: No such file or directory pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong version of openssl.cnf: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa The correct version should have a comment that says: easy-rsa version 2.x [/code] Finally: I removed the ending part of the export and also took out the quotes: [code]export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf[/code] And now it actually worked to start the build-ca process! Why in heavens name does not the whichopensslcnf script work on 2.4.0?

[quote=TinCanTech post_id=73794 time=1509014020 user_id=37053] [quote=BobAGI post_id=73787 time=1509001864 user_id=27535] Seems to be a lot for Windows... [/quote]You did not mention windows before ? [/quote]Not in this thread... The first line says: I am trying to set up an OpenVPN server on a brand new RPi3B with [u]Raspbian Stretch[/u] from the Sept 2017 image.[quote] [quote=BobAGI post_id=73787 time=1509001864 user_id=27535] What do I use on a Raspbian Stretch (Debian-Linux-ARM) platform? [/quote]I believe you should be able to use https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz As you are using Raspian I cannot be sure, please try it and let us know. The *.tgz are for Linux while the *.zip are for Windows. [/quote] I did a wget on the tgz file and then tar -xvzf on the downloaded file. That gave me a directory EasyRSA-3.0.3 containing this: [code]drwxr-xr-x 4 pi pi 4096 Oct 26 17:43 . drwxr-xr-x 3 pi pi 4096 Oct 26 17:40 .. -rw-r--r-- 1 pi pi 2415 Sep 2 2015 ChangeLog -rw-r--r-- 1 pi pi 1305 Aug 21 21:31 COPYING.md drwxr-xr-x 2 pi pi 4096 Oct 26 17:40 doc -rwxr-xr-x 1 pi pi 35985 Aug 21 21:31 easyrsa -rw-r--r-- 1 pi pi 18093 Sep 2 2015 gpl-2.0.txt -rw-r--r-- 1 pi pi 4560 Sep 2 2015 openssl-1.0.cnf -rw-r--r-- 1 pi pi 3350 Sep 2 2015 README.quickstart.md -rw-r--r-- 1 pi pi 8126 Sep 2 2015 vars.example drwxr-xr-x 2 pi pi 4096 Aug 21 22:55 x509-types [/code] Now I am stuck again because none of the scripts I am used to from easy-rsa are present, and the only directory here is the doc, which contains just documents. Since I managed to somehow "solve" my problem by discarding the use of whichopensslcnf and instead setting the cnf file directly in the vars file, I might as well try that path. Yesterday I managed to create the ca by running build-ca but then it was too late to go on, well after midnight here...

Try running [b]easyrsa[/b] :roll:

Stuck in easy-rsa on 2.4.0 install on Raspbian stretch

BobAGI

I am trying to set up an OpenVPN server on a brand new RPi3B with Raspbian Stretch from the Sept 2017 image.
I have performed all the usual steps using apt-get to install openvpn and it got me version 2.4.0
Previous installations I have done on Raspbian Wheezy ended up with 2.1.xx.

On 2.4.0 easy-rsa is part of the install but is hidden in /usr/share/easy-rsa, so I copied it to /etc/openvpn/easy-rsa

Now I have edited the vars script and it seemed satisfied after I replaced the double quotes in these lines:

export EASY_RSA="/etc/openvpn/easy-rsa"
export KEY_CONFIG="$EASY_RSA/whichopensslcnf $EASY_RSA"

But when I run the command ./build-ca I get this displayed:

root@rpi3-vpn:/etc/openvpn/easy-rsa# ./build-ca
grep: /etc/openvpn/easy-rsa/whichopensslcnf /etc/openvpn/easy-rsa: No such file or directory
pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
version of openssl.cnf: /etc/openvpn/easy-rsa/whichopensslcnf /etc/openvpn/easy-rsa
The correct version should have a comment that says: easy-rsa version 2.x

What does this mean and what can I do to fix it?
I checked the openssl version:

root@rpi3-vpn:/etc/openvpn/easy-rsa# openssl version
OpenSSL 1.1.0f  25 May 2017

And in the easy-rsa dir there are the following sample openssl.cnf files:

-rw-r--r--   1 root root  7859 Jul 13  2015 openssl-0.9.6.cnf
-rw-r--r--   1 root root  8416 Jul 13  2015 openssl-0.9.8.cnf
-rw-r--r--   1 root root  8313 Jul 13  2015 openssl-1.0.0.cnf

If I look at the openssl-1.0.0.cnf file the very first line is this comment:

# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*

So it does in fact mention easy-rsa 2.0...

In earlier installations I did not touch the KEY_CONFIG line so it looked like this by default:

export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`

But if I go back to those quotes I get this error message:

root@rpi3-vpn:/etc/openvpn/easy-rsa# source ./vars
**************************************************************
  No /etc/openvpn/easy-rsa/openssl.cnf file could be found
  Further invocations will fail
**************************************************************

I am really at a loss here, since no howto I find on the net for OpenVPN on Raspbian Stretch seems to work.
Can someone please advice as to why the openssl is not correctly configured in this case?
And of course tell me what to do to fix it....
Should I just replace the use of whichopensslcnf with this line:

export KEY_CONFIG="$EASY_RSA/openssl-1.0.0.cnf $EASY_RSA"

But of course it did not cut it:

root@rpi3-vpn:/etc/openvpn/easy-rsa# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
root@rpi3-vpn:/etc/openvpn/easy-rsa# ./build-ca
grep: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa: No such file or directory
pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
version of openssl.cnf: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa
The correct version should have a comment that says: easy-rsa version 2.x

Finally: I removed the ending part of the export and also took out the quotes:

export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf

And now it actually worked to start the build-ca process!
Why in heavens name does not the whichopensslcnf script work on 2.4.0?

TinCanTech

Simple answer:
https://github.com/OpenVPN/easy-rsa/releases

BobAGI

Seems to be a lot for Windows...
What do I use on a Raspbian Stretch (Debian-Linux-ARM) platform?
There are binaries, which presumably are compiled for some CPU architecture, but which?
The easy-rsa shipped with OpenVPN (via apt-get install) does not contain binaries as far as I know.
Should it?

TinCanTech

BobAGI wrote Seems to be a lot for Windows...

You did not mention windows before ?

BobAGI wrote What do I use on a Raspbian Stretch (Debian-Linux-ARM) platform?

I believe you should be able to use https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz

As you are using Raspian I cannot be sure, please try it and let us know.

The *.tgz are for Linux while the *.zip are for Windows.

The extra binaries included with the Windows version are in order to provide a working *Nix like Shell.

BobAGI

TinCanTech wrote
BobAGI wrote Seems to be a lot for Windows...
You did not mention windows before ?

Not in this thread...
The first line says:
I am trying to set up an OpenVPN server on a brand new RPi3B with Raspbian Stretch from the Sept 2017 image.

BobAGI wrote What do I use on a Raspbian Stretch (Debian-Linux-ARM) platform?
I believe you should be able to use https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz

As you are using Raspian I cannot be sure, please try it and let us know.

The *.tgz are for Linux while the *.zip are for Windows.

I did a wget on the tgz file and then tar -xvzf on the downloaded file.
That gave me a directory EasyRSA-3.0.3 containing this:

drwxr-xr-x 4 pi pi  4096 Oct 26 17:43 .
drwxr-xr-x 3 pi pi  4096 Oct 26 17:40 ..
-rw-r--r-- 1 pi pi  2415 Sep  2  2015 ChangeLog
-rw-r--r-- 1 pi pi  1305 Aug 21 21:31 COPYING.md
drwxr-xr-x 2 pi pi  4096 Oct 26 17:40 doc
-rwxr-xr-x 1 pi pi 35985 Aug 21 21:31 easyrsa
-rw-r--r-- 1 pi pi 18093 Sep  2  2015 gpl-2.0.txt
-rw-r--r-- 1 pi pi  4560 Sep  2  2015 openssl-1.0.cnf
-rw-r--r-- 1 pi pi  3350 Sep  2  2015 README.quickstart.md
-rw-r--r-- 1 pi pi  8126 Sep  2  2015 vars.example
drwxr-xr-x 2 pi pi  4096 Aug 21 22:55 x509-types

Now I am stuck again because none of the scripts I am used to from easy-rsa are present, and the only directory here is the doc, which contains just documents.

Since I managed to somehow "solve" my problem by discarding the use of whichopensslcnf and instead setting the cnf file directly in the vars file, I might as well try that path.
Yesterday I managed to create the ca by running build-ca but then it was too late to go on, well after midnight here...

TinCanTech

Try running easyrsa

:roll:

BobAGI

Regarding using easyrsa as the command I have a problem since there are no OpenVPN installation howto:s I have read that use it, they all refer to the individual scripts available in earlier releases of easy-rsa....

Fix for whichopensslcnf
I now found that the the script whichopensslcnf is flawed after inspecting it and checking my system out...
The version of openssl is found like this:

# openssl version
OpenSSL 1.1.0f  25 May 2017

Notice that the version is 1.1.0
Now in the whichopensslcnf script this is being done:

#!/bin/sh

cnf="$1/openssl.cnf"

if [ "$OPENSSL" ]; then
    if $OPENSSL version | grep -E "0\.9\.6[[:alnum:]]?" > /dev/null; then
        cnf="$1/openssl-0.9.6.cnf"
    elif $OPENSSL version | grep -E "0\.9\.8[[:alnum:]]?" > /dev/null; then
        cnf="$1/openssl-0.9.8.cnf"
    elif $OPENSSL version | grep -E "1\.0\.[[:digit:]][[:alnum:]]?" > /dev/null; then
        cnf="$1/openssl-1.0.0.cnf"
    else
        cnf="$1/openssl.cnf"
    fi
fi
echo $cnf

if [ ! -r $cnf ]; then
    echo "**************************************************************" >&2
    echo "  No $cnf file could be found" >&2
    echo "  Further invocations will fail" >&2
    echo "**************************************************************" >&2
fi
exit 0

What I realized is that the script does not zero in on the 1.0.0 cnf for 1.1.x openssl so what I did was adding this after the last file check right before else:

    elif $OPENSSL version | grep -E "1\.1\.[[:digit:]][[:alnum:]]?" > /dev/null; then
        cnf="$1/openssl-1.0.0.cnf"

I guess that this is not really the correct way since probably the openvpn installer should have provided a cnf file for openssl 1.1.x too.
But the 1.0.0 file seems to work just fine so this is a way to fix the problem until there is a correct cnf file available for 1.1.0.
At that time the script needs to be changed to point to this new cnf file of course.

TinCanTech

https://community.openvpn.net/openvpn/wiki/EasyRSA