server cert expired, rebuilt but no luck

qwertyjjj

My server cert seems to have expired as all client connections suddenly stop working on 1st January with the error:
2020-01-05 14:11:42 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=GB, ST=LND, O=SERVERNAME, CN=SERVERNAME, emailAddress=a@ab.com
2020-01-05 14:11:42 New OpenVPN Status (RECONNECTING->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): tls-error,,,,,
2020-01-05 14:11:42 New OpenVPN Status (RECONNECTING->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): tls-error,,,,,
2020-01-05 14:11:42 New OpenVPN Status (CONNECTRETRY->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): 2
2020-01-05 14:11:42 New OpenVPN Status (CONNECTRETRY->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): 2
2020-01-05 14:11:42 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-01-05 14:11:42 TLS_ERROR: BIO read tls_read_plaintext error
2020-01-05 14:11:42 TLS Error: TLS object -> incoming plaintext read error
2020-01-05 14:11:42 TLS Error: TLS handshake failed
2020-01-05 14:11:42 TCP/UDP: Closing socket

I rebuilt the server cert and restarted openvpn but still have the same problem.
I tried tls-cipher DEFAULT:@SECLEVEL=0 in the client as a test but that does not work.
ANy ideaas what to fix?

TinCanTech

Use EasyRSA3 to build a new PKI from scratch, https://github.com/OpenVPN/easy-rsa/releases/tag/v3.0.6
including all server and clients and then manage your PKI with confidence.

qwertyjjj

I have too many clients to send out all new certificates.
Why would it suddenly happen this anyway?
Cant I just rebuild using md5?

TinCanTech

qwertyjjj wrote I have too many clients to send out all new certificates

Correction: You have too many clients to care about their security.

qwertyjjj

What would cause the sudden issue that I can use easy RSA 2?

TinCanTech

qwertyjjj wrote VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak

Presuming this is due to old certificate using md5 hash ..

qwertyjjj wrote OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

OpenSSL does not allow use of md5 hash

qwertyjjj wrote Cant I just rebuild using md5?

What ever that means ..

If you care about your client's security you will build a secure PKI. Use Easy RSA 3 above ..

300000

qwertyjjj wrote I have too many clients to send out all new certificates.
Why would it suddenly happen this anyway?
Cant I just rebuild using md5?

this is free software , someone is setting it 10 years from the first day you created certificate . now it is end of the life you must do it from start there is no way around it by any mean . if you know how cetificate you should set time is 100 years not 10 years. you did enjoy 10 years free software now you need to build the whole certificate and update all the client with new certificate .

XCA software can make you certificate more fun to play and make the thing quicker for you if you like .