Hello, I'm having a trouble getting EasyRSA 3.0.8 working on Windows 11 dev channel (Windows Insider) with the command '[i]./easyrsa build-ca nopass[/i]'. This is OpenVPN-2.5.4-I604-amd64.msi from https://openvpn.net/community-downloads/ I follow this 'how to' (tuto) : https://shebangthedolphins.net/vpn_openvpn_windows_server.html [code]C:\Program Files\OpenVPN\easy-rsa>EasyRSA-Start.bat Welcome to the EasyRSA 3 Shell for Windows. Easy-RSA 3 is available under a GNU GPLv2 license. Invoke './easyrsa' to call the program. Without commands, help is displayed. EasyRSA Shell EasyRSA Shell # ./easyrsa build-ca nopass Using SSL: openssl OpenSSL 1.1.1l 24 Aug 2021 Easy-RSA error: The OpenSSL config file cannot be found. Expected location: C:/Program Files/OpenVPN/easy-rsa/pki/openssl-easyrsa.cnf EasyRSA Shell EasyRSA Shell # cp -iv openssl-easyrsa.cnf "C:/Program Files/OpenVPN/easy-rsa/pki/openssl-easyrsa.cnf" openssl-easyrsa.cnf -> C:/Program Files/OpenVPN/easy-rsa/pki/openssl-easyrsa.cnf EasyRSA Shell # ./easyrsa build-ca nopass Using SSL: openssl OpenSSL 1.1.1l 24 Aug 2021 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-15456.a07364/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8C67.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8C67.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-15456.a07364/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8D32.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8D32.tmp fd = 3 Generating RSA private key, 2048 bit long modulus (2 primes) .................................+++++ ...................................+++++ e is 65537 (0x010001) path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-15456.a07364/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8EF7.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmp8EF7.tmp fd = 3 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:DESKTOP-P2SN4KI CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: C:/Program Files/OpenVPN/easy-rsa/pki/ca.crt #[/code] Thanks in advance. Valorisa

[code]Microsoft Windows [version 10.0.22499.1000] (c) Microsoft Corporation. Tous droits réservés. C:\Windows\System32>cd C:\Program Files\OpenVPN\easy-rsa && EasyRSA-Start.bat Welcome to the EasyRSA 3 Shell for Windows. Easy-RSA 3 is available under a GNU GPLv2 license. Invoke './easyrsa' to call the program. Without commands, help is displayed. EasyRSA Shell # ./easyrsa build-server-full server nopass Using SSL: openssl OpenSSL 1.1.1l 24 Aug 2021 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp fd = 3 Generating a RSA private key ......................................................+++++ .....................+++++ writing new private key to 'C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.a01488' ----- Easy-RSA error: Unknown cert type 'server' Easy-RSA error: Failed to sign 'server' EasyRSA Shell[/code]

[quote=TinCanTech post_id=103091 time=1636719956 user_id=37053] You got it working ? [/quote] For the copy of [b]openssl-easyrsa.cnf[/b] in the good location it's ok but now with the command : '[i]# ./easyrsa build-server-full server nopass[/i]' I obtain the error : [code]# ./easyrsa build-server-full server nopass Using SSL: openssl OpenSSL 1.1.1l 24 Aug 2021 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp fd = 3 Generating a RSA private key ......................................................+++++ .....................+++++ writing new private key to 'C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.a01488' ----- Easy-RSA error: Unknown cert type 'server' Easy-RSA error: Failed to sign 'server' EasyRSA Shell #[/code]

Do you know which version of Easy-RSA3 you have ? Edit: OK Windows version. I believe there is a known bug. https://github.com/OpenVPN/easy-rsa/issues Not sure which one ..

This one may be .. https://github.com/OpenVPN/easy-rsa/issues/412 Try copying EasyRSA to a path without spaces ..

[quote=TinCanTech post_id=103093 time=1636722730 user_id=37053] Do you know which version of Easy-RSA3 you have ? Edit: OK Windows version. I believe there is a known bug. https://github.com/OpenVPN/easy-rsa/issues Not sure which one .. [/quote] [b]OpenVPN-2.5.4-I604-amd64[/b] and [b]EasyRSA 3.0.8[/b] [code]EasyRSA Shell # ./easyrsa --version EasyRSA Version Information Version: 3.0.8 Generated: Wed Sep 16 07:52:24 CDT 2020 SSL Lib: OpenSSL 1.1.1l 24 Aug 2021 Git Commit: a9cecc747c419197d9540ccd46259559e271788a Source Repo: https://github.com/OpenVPN/easy-rsa[/code]

[quote=valorisa34 post_id=103088 time=1636712603 user_id=55374] [code]Microsoft Windows [version 10.0.22499.1000] (c) Microsoft Corporation. Tous droits réservés. C:\Windows\System32>cd C:\Program Files\OpenVPN\easy-rsa && EasyRSA-Start.bat Welcome to the EasyRSA 3 Shell for Windows. Easy-RSA 3 is available under a GNU GPLv2 license. Invoke './easyrsa' to call the program. Without commands, help is displayed. EasyRSA Shell # ./easyrsa build-server-full server nopass Using SSL: openssl OpenSSL 1.1.1l 24 Aug 2021 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD486.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD551.tmp fd = 3 path = C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.XXXXXX lpPathBuffer = C:\Users\BERTRA~1\AppData\Local\Temp\ szTempName = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp path = C:\Users\BERTRA~1\AppData\Local\Temp\tmpD5FD.tmp fd = 3 Generating a RSA private key ......................................................+++++ .....................+++++ writing new private key to 'C:/Program Files/OpenVPN/easy-rsa/pki/easy-rsa-14380.a06920/tmp.a01488' ----- Easy-RSA error: Unknown cert type 'server' Easy-RSA error: Failed to sign 'server' EasyRSA Shell[/code] [/quote] Have other people seen this same problem ?

" [i]Workaround: create a directory with no spaces in the name, eg. C:\temp In EasyRSA vars use set_var EASYRSA_TEMP_DIR "/temp" and run build-ca[/i] "

Within the EasyRSA Shell ? Aand if so, how exactly do you do that ?

Windows 11 - openssl-easyrsa.cnf not found in easy-rsa 3

TinCanTech

I believe the problem is here (easyrsa:line 1738):

	# Same as above for the x509-types extensions dir
	if [ -d "$EASYRSA_PKI/x509-types" ]; then
		set_var EASYRSA_EXT_DIR		"$EASYRSA_PKI/x509-types"
	else	
		#TODO: This should be removed.  Not really suitable for packaging.
		set_var EASYRSA_EXT_DIR		"$EASYRSA/x509-types"
	fi

If you feel confident to edit the source file then replace that(above) with this(below):

	# Same as above for the x509-types extensions dir
	if [ -d "$EASYRSA_PKI/x509-types" ]; then
		set_var EASYRSA_EXT_DIR		"$EASYRSA_PKI/x509-types"
	elif [ -d "$EASYRSA/x509-types" ]; then
		#TODO: This should be removed.  Not really suitable for packaging.
		set_var EASYRSA_EXT_DIR		"$EASYRSA/x509-types"
	else
		die "Missing x509-types folder"
	fi

I have posted a patch here, which you will be testing:
https://github.com/OpenVPN/easy-rsa/pull/466
https://patch-diff.githubusercontent.com/raw/OpenVPN/easy-rsa/pull/466.patch

valorisa34

Thanks Richard. How tu use the patch please ?

valorisa34

How to edit precisely the source file to make the replacement ?
Notepad++ for example (https://notepad-plus-plus.org/) ?

valorisa34

Replacement done with Notepad++

TinCanTech

This change will not fix your issue but it will help us to figure out what is going wrong..

valorisa34

After the replacement in line 1738, now I obtain this :

# ./easyrsa build-ca nopass

Easy-RSA error:

Missing x509-types folder

EasyRSA Shell

TinCanTech

That is exactly the result I was expecting.

Please change this (line:1745):

		die "Missing x509-types folder"

to this:

		die "Missing x509-types folder: $EASYRSA/x509-types"

and try once more..

valorisa34

OK, I try this modification.

valorisa34

Hello Richard,
The last result with modification : ' die "Missing x509-types folder: $EASYRSA/x509-types" '

C:\PROGRA~1\OpenVPN\easy-rsa>easyrsa-start.bat

Welcome to the EasyRSA 3 Shell for Windows.
Easy-RSA 3 is available under a GNU GPLv2 license.

Invoke './easyrsa' to call the program. Without commands, help is displayed.

EasyRSA Shell
# ./easyrsa init-pki

Easy-RSA error:

Missing x509-types folder: /cygdrive/c/PROGRA~1/OpenVPN/easy-rsa/x509-types

EasyRSA Shell
#

You can see /cygdrive/c because I have Cygwin installed for several months.

TinCanTech

valorisa34 wrote Easy-RSA error:

Missing x509-types folder: /cygdrive/c/PROGRA~1/OpenVPN/easy-rsa/x509-types

I believe Easy-RSA shell does not understand your drive naming format.

Try a different disk or something..

TinCanTech

If you care to join me on IRC, there are some tests we could try ..

https://web.libera.chat/ channel #tincantech

valorisa34

Ok. Asap with my PC. Thanks.

TinCanTech

If you find time to test then please test these two commands:

pwd
echo $PWD

thanks.

Ref: https://github.com/OpenVPN/easy-rsa/issues/467

valorisa34

EasyRSA Shell
# pwd
C:/EasyRSA3

EasyRSA Shell
# echo $PWD
C:/EasyRSA3

EasyRSA Shell
#

valorisa34

For the OpenVPN client, I use a Android smartphone from which I've installed 'OpenVPN Connect' from Play Store.

The log gives :

22:49:05.697 -- Transport Error: UDP connect error on '***********.ddnsfree.com:1194' ([**************************]:1194): Network is unreachable

22:49:05.697 -- Client terminated, restarting in 2000 ms...

22:49:07.698 -- EVENT: RECONNECTING

22:49:07.703 -- EVENT: RESOLVE

22:49:07.713 -- Contacting ***************:1194 via UDP

22:49:07.714 -- EVENT: WAIT

22:49:07.717 -- Connecting to [**********.ddnsfree.com]:1194 (***************) via UDPv4

23:32:20.209 -- EVENT: RECONNECTING

23:32:20.211 -- EVENT: RESOLVE

23:32:20.219 -- Contacting ******************:1194 via UDP

23:32:20.220 -- EVENT: WAIT

23:32:20.222 -- Connecting to [********************.ddnsfree.com]:1194 (*****************) via UDPv4

23:32:24.920 -- EVENT: DISCONNECTED

23:32:24.921 -- Tunnel bytes per CPU second: 0

23:32:24.921 -- ----- OpenVPN Stop -----

TinCanTech

See your server log for errors.

valorisa34

I post the new problem in another place.

TinCanTech

Also, because you are using Windows, make sure you open Port UDP:1194 for openvpn , in your server firewall.

« Previous Page