Error: private key password verification failed

quidn

Hi,

I just set up a new OpenVPN server and having trouble connecting to it. See a log file attached to this

  $ openssl rsa -pubout < client.key  | md5
  ced1920e9e99be57146864d09e9e0684

  $ openssl x509 -noout -pubkey < client.crt | md5
  ced1920e9e99be57146864d09e9e0684

Generated entire credential pairs for server & clients on two different machines the error is still persistent.

Credentials are generated using the following command:

   ./easyrsa build-<client|server>-full <name> nopass

It would be grateful if anyone can help me out.

remote example.net 1194
client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
auth-nocache
persist-tun
float
<ca>
[Security-related line(s) omitted]
</ca>
<cert>
[Security-related line(s) omitted]
</cert>
<key>
[Security-related line(s) omitted]
</key>

2018-03-24 19:01:28 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Mar 2 2018
2018-03-24 19:01:28 library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.10
2018-03-24 19:01:28 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2018-03-24 19:01:28 Need hold release from management interface, waiting...
*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.5 (build 5010); prior version 3.7.4b (build 4921)
2018-03-24 19:01:28 *Tunnelblick: Attempting connection with user@example.net using shadow copy; Set nameserver = 769; monitoring connection
2018-03-24 19:01:28 *Tunnelblick: openvpnstart start user@example.net.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.4-openssl-1.0.2n
2018-03-24 19:01:29 *Tunnelblick: openvpnstart log:
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-openssl-1.0.2n/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-Suser-SLibrary-SApplication Support-STunnelblick-SConfigurations-Suser@example.net.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Users/user/user@example.net.tblk/Contents/Resources
--setenv
IV_GUI_VER
"net.tunnelblick.tunnelblick 5010 3.7.5 (build 5010)"
--verb
3
--config
/Library/Application Support/Tunnelblick/Users/user/user@example.net.tblk/Contents/Resources/config.ovpn
--verb
3
--cd
/Library/Application Support/Tunnelblick/Users/user/user@example.net.tblk/Contents/Resources
--management
127.0.0.1
1337
/Library/Application Support/Tunnelblick/ioacmhbglbhpamdpigbnpmefimcnhpccleembjal.mip
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2018-03-24 19:01:28 *Tunnelblick: openvpnstart starting OpenVPN
2018-03-24 19:01:29 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2018-03-24 19:01:29 MANAGEMENT: CMD 'pid'
2018-03-24 19:01:29 MANAGEMENT: CMD 'state on'
2018-03-24 19:01:29 MANAGEMENT: CMD 'state'
2018-03-24 19:01:29 MANAGEMENT: CMD 'bytecount 1'
2018-03-24 19:01:29 MANAGEMENT: CMD 'hold release'
2018-03-24 19:01:29 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-03-24 19:01:29 MANAGEMENT: Client disconnected
2018-03-24 19:01:29 Error: private key password verification failed
2018-03-24 19:01:29 Exiting due to fatal error
2018-03-24 19:01:29 *Tunnelblick: Established communication with OpenVPN
2018-03-24 19:01:30 *Tunnelblick: Disconnecting; user cancelled authorization or there was an error obtaining authorization
2018-03-24 19:01:31 *Tunnelblick: No 'pre-disconnect.sh' script to execute
2018-03-24 19:01:31 *Tunnelblick: Disconnecting using 'kill'
2018-03-24 19:01:32 *Tunnelblick: No 'post-disconnect.sh' script to execute
2018-03-24 19:01:32 *Tunnelblick: Expected disconnection occurred.

TinCanTech

Which version of easyrsa did you use ?

quidn

Used v3.0.4 got from https://github.com/OpenVPN/easy-rsa/releases

TinCanTech

You can try adding --askpass to your config file .. or
You can try removing the password

Both methods will ask you for the current password.

If you don't know the password the easiest thing to do is create a new certificate+key ..
or even start the entire PKI from scratch.

quidn

The server & client credentials were created without passphrase (i.e. with `nopass` argument).

I did try to create new key pairs and started the entire PKI on a different machine but still getting the same error message.

TinCanTech

Are you using Linux or Windows machine to create your PKI ?

quidn

Used Mac machines to generate them.

TinCanTech

I have just created two new PKIs on Linux, one with and one without passphrases and do not see the problem.

Can you create a quick test PKI now and then paste the output of your terminal window showing the steps you take to create the PKI and the output from easyrsa.

EG:

me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $ ./easyrsa init-pki

Note: using Easy-RSA configuration from: ./vars


WARNING!!!

You are about to remove the EASYRSA_PKI at: /home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki
and initialize a fresh PKI here.

Type the word 'yes' to continue, or any other input to abort.
  Confirm removal: yes

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki

me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $ ./easyrsa build-ca

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
.............................................................................................................................+++
.......................+++
writing new private key to '/home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/ca.key.Gg6XF1WsOp'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
140429633050272:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:You must type in 4 to 1024 characters
140429633050272:error:0906406D:PEM routines:PEM_def_callback:problems getting password:pem_lib.c:111:
140429633050272:error:0907E06F:PEM routines:DO_PK8PKEY:read key:pem_pk8.c:130:

Easy-RSA error:

Failed to build the CA
me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $ ./easyrsa build-ca

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
.............+++
....................+++
writing new private key to '/home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/ca.key.zecimuElQ5'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/ca.crt

me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $ ./easyrsa build-server-full test-s01

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
.............................................+++
........................................................................+++
writing new private key to '/home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/test-s01.key.uiPaCp5kFJ'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'test-s01'
Certificate is to be certified until Mar 22 13:30:43 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $ ./easyrsa build-client-full test-c01

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
...................+++
...+++
writing new private key to '/home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/test-c01.key.IswcnAET2V'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /home/me/Downloads/EasyRSA/EasyRSA-3.0.4/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'test-c01'
Certificate is to be certified until Mar 22 13:31:02 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
me@home ~/Downloads/EasyRSA/EasyRSA-3.0.4 $

quidn

My test PKI

~$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 9.4 (stretch)
Release:        9.4
Codename:       stretch

~$ mkdir easyrsa3

~$ cd easyrsa3/

~/easyrsa3$ wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz -q

~/easyrsa3$ tar -xzf EasyRSA-3.0.4.tgz 

~/easyrsa3$ cd EasyRSA-3.0.4/

~/easyrsa3/EasyRSA-3.0.4$ cp vars.example vars

~/easyrsa3/EasyRSA-3.0.4$ vi vars

~/easyrsa3/EasyRSA-3.0.4$ diff vars vars.example
91,96c91,96
< set_var EASYRSA_REQ_COUNTRY   "US"
< set_var EASYRSA_REQ_PROVINCE  "Some State"
< set_var EASYRSA_REQ_CITY      "Some City"
< set_var EASYRSA_REQ_ORG       "Some Org"
< set_var EASYRSA_REQ_EMAIL     "some-email@example.com"
< set_var EASYRSA_REQ_OU                "Some Organizational Unit"
---
> #set_var EASYRSA_REQ_COUNTRY  "US"
> #set_var EASYRSA_REQ_PROVINCE "California"
> #set_var EASYRSA_REQ_CITY     "San Francisco"
> #set_var EASYRSA_REQ_ORG      "Copyleft Certificate Co"
> #set_var EASYRSA_REQ_EMAIL    "me@example.net"
> #set_var EASYRSA_REQ_OU               "My Organizational Unit"
104c104
< set_var EASYRSA_KEY_SIZE      2048
---
> #set_var EASYRSA_KEY_SIZE     2048

~/easyrsa3/EasyRSA-3.0.4$ ./easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/user/easyrsa3/EasyRSA-3.0.4/pki

~/easyrsa3/EasyRSA-3.0.4$ ./easyrsa build-ca nopass

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
..........................................................................................................+++
...................+++
writing new private key to '/home/user/easyrsa3/EasyRSA-3.0.4/pki/private/ca.key.YlNb3EOaET'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Some CA
into your certificate request.
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/home/user/easyrsa3/EasyRSA-3.0.4/pki/ca.crt

~/easyrsa3/EasyRSA-3.0.4$ ./easyrsa build-server-full server nopass
Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
............................+++
........................................................................................................................................+++
writing new private key to '/home/user/easyrsa3/EasyRSA-3.0.4/pki/private/server.key.DoPsvGEEBh'
-----
Using configuration from ./openssl-easyrsa.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server'
Certificate is to be certified until Mar 22 13:45:16 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated

~/easyrsa3/EasyRSA-3.0.4$ ./easyrsa build-client-full someuser@example.org nopass
Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
.+++
.......................................................................+++
writing new private key to '/home/user/easyrsa3/EasyRSA-3.0.4/pki/private/someuser@example.org.key.L9ccfeHFqQ'
-----
Using configuration from ./openssl-easyrsa.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'someuser@example.org'
Certificate is to be certified until Mar 22 13:45:53 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
ote: using Easy-RSA configuration from: ./vars
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...........................................................+...............................................................................+................


...
..
........................................................................................+...................................................................
..........++*++*
DH parameters of size 2048 created at /home/user/easyrsa3/EasyRSA-3.0.4/pki/dh.pem

quidn

Linux generated credentials work 🙂

TinCanTech

So .. is there something wrong when you use MAC to generate a PKI ?

If there is we would like very much to know about it ..

quidn

I used the same commands on two different OSes.

Both Mac machines run macOS Sierra. Maybe there is a problem in openssl which comes with the OS?

TinCanTech

Can you paste your term window from a MAC while creating a new PKI ?
Test the new PKI for the same problem first.

The reason is that EasyRSA decides if there is to be a password or not depending on the options you specify.
If MAC is running the wrong command it should be easy to detect with your output .. if it happens again.