I have an OpenVPN server, from which I have issued certificates (.crt/.key) for use on several remote clients. I am getting the following error in the connection's log file: [quote] OpenSSL: error:C5065064:microsoft cryptoapi:CertFindCertificateInStore:Cannot find the certificate and private key for decryption. Cannot load certificate "THUMB: from Microsoft Certificate Store" Exiting due to fatal error [/quote] Here is the relevent portion of my config file: [oconf=Server Config] ca "C:\\Program Files\\OpenVPN\config\.ca.crt" cryptoapicert "THUMB: " [/oconf] Here are the steps I have taken: [list=]Imported the .crt file into the Local Computer cert store (Personal)[/list] [list=]Started OpenVPNService as the Local System account[/list] [list=]Verified that I manually typed (and typed correctly) the thumbprint, instead of copy/paste from the MMC[/list] [list=]Changed property from "THUMB..." to "SUBJ: " (the OU has a space which I did not enclose in quotes). There will be only one OpenVPN cert per device so maybe I should use "SUBJ:"? [/list] When I change the config file to the following, the connection is successful: [oconf=Server Config] ca "C:\\Program Files\\OpenVPN\config\.ca.crt" cert "C:\\Program Files\\OpenVPN\config\.crt" key "C:\\Program Files\\OpenVPN\config\.key" [/oconf] I had originally imported just the .crt file (no private key) into the cert store, but the object could not be found per the log file), so I copied the public and private keys into a .pem file and imported that into the cert store. Not sure where to go from here. Thoughts? Thanks. UPDATE: I figured out that if I use openssl.exe, that I can create a .pfx file. Then I used the "start .pfx" command to start the GUI import to the cert store. After selecting the Local Machine store (and Personal), I restarted the service and got connected. Yay. So to automate this config, I deleted the imported cert and ran the command: [code]Import-PfxCertificate -Password $password -CertStoreLocation Cert:\LocalMachine\My -FilePath [/code] The import worked and I could see the cert in the MMC, but now OpenVPN will not connect. Thoughts?

Cryptoapi error C5065064

wetlingsyn

I have an OpenVPN server, from which I have issued certificates (.crt/.key) for use on several remote clients. I am getting the following error in the connection's log file:

OpenSSL: error:C5065064:microsoft cryptoapi:CertFindCertificateInStore:Cannot find the certificate and private key for decryption.
Cannot load certificate "THUMB: <thumbprint> from Microsoft Certificate Store"
Exiting due to fatal error

Here is the relevent portion of my config file:

ca "C:\\Program Files\\OpenVPN\config\<name>.ca.crt"
cryptoapicert "THUMB: <thumbprint>"

Here are the steps I have taken:

Imported the .crt file into the Local Computer cert store (Personal)

Started OpenVPNService as the Local System account

Verified that I manually typed (and typed correctly) the thumbprint, instead of copy/paste from the MMC

Changed property from "THUMB..." to "SUBJ:<country> <state> <location> <ou> <cn> <email>" (the OU has a space which I did not enclose in quotes). There will be only one OpenVPN cert per device so maybe I should use "SUBJ:<email>"?

When I change the config file to the following, the connection is successful:

ca "C:\\Program Files\\OpenVPN\config\<name>.ca.crt"
cert "C:\\Program Files\\OpenVPN\config\<name>.crt"
key "C:\\Program Files\\OpenVPN\config\<name>.key"

I had originally imported just the .crt file (no private key) into the cert store, but the object could not be found per the log file), so I copied the public and private keys into a .pem file and imported that into the cert store.

Not sure where to go from here. Thoughts? Thanks.

UPDATE: I figured out that if I use openssl.exe, that I can create a .pfx file. Then I used the "start <certname>.pfx" command to start the GUI import to the cert store. After selecting the Local Machine store (and Personal), I restarted the service and got connected. Yay.

So to automate this config, I deleted the imported cert and ran the command:

Import-PfxCertificate -Password $password -CertStoreLocation Cert:\LocalMachine\My -FilePath <path to .pfx>

The import worked and I could see the cert in the MMC, but now OpenVPN will not connect. Thoughts?

wetlingsyn

I ended up using code similar to what is in this post: https://stackoverflow.com/questions/16049890/powershell-import-pfx-and-private-key-lost, to import the pfx cert and everything works after.