Hello, i own a Linksys WRT 3200ACM router that supports openvpn server out of the box. i've been running that said server for the past 5 years. Today, out of the blue, i received the above error and i cannot connect to the server. Researching online and on openvpn forums, it seems that the server certificate has expired (https://forums.openvpn.net/viewtopic.php?t=32568) i checked the configuration that gets generated by the router's interface, as you will see it has a 10-year validity and expires today: Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=CA, L=Irvine, O=Linksys, OU=Belkin, CN=Mamba/name=BlackMamba/emailAddress=support@linksys.com Validity Not Before: Oct 11 06:00:52 2012 GMT [b]Not After : Oct 9 06:00:52 2022 GMT[/b] Subject: C=US, ST=CA, L=Irvine, O=Linksys, OU=Belkin, CN=client/name=BlackMamba/emailAddress=support@linksys.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: i tried changing the date in the configuration file, but that didn't work - assuming it is embedded in the actual certificate. I contacted linksys for this issue; however they asked me to raise a ticket with openvpn. below is the transcript of my conversation with them. 99.9% this is an issue with linksys and not with openvpn. but i would really appreciate it if you can give me some guidance on what to tell them or what needs to be done from their end. If there's something that can be done by myself, more than happy to try it. i already tried deleting all configurations etc on the router and reissuing new ones. but i still get same error across all devices. thanks Jeziah May L (10/9/2022, 5:50:18 PM): Hello Minas. Welcome to Linksys Chat! My name is Jeziah, is this your first time with us? Minas (10/9/2022, 5:50:40 PM): Hello, yes first time Jeziah May L (10/9/2022, 5:51:00 PM): Can you tell me more about it? Minas (10/9/2022, 5:51:43 PM): So, i purchased this router, and i was using open vpn server fine for the past 4-5 years without an issue. today i receive an error on the client side that the certificate has expired Minas (10/9/2022, 5:52:25 PM): i researched a bit, and it seems that those openvpn server certificates do expire over time. there are some instructions on how to update them, but those are for openvpn servers not sitting on linksys routers Minas (10/9/2022, 5:52:33 PM): i have no idea how these get updated on linksys Jeziah May L (10/9/2022, 5:52:36 PM): im reading your messages Jeziah May L (10/9/2022, 5:53:22 PM): our device is just vpn pass through and vpn is actually not supported Jeziah May L (10/9/2022, 5:53:31 PM): it should be on a 3rd party Minas Minas (10/9/2022, 5:53:33 PM): no that's wrong Jeziah May L (10/9/2022, 5:53:39 PM): what do you mean Minas (10/9/2022, 5:53:56 PM): WRT ac3200ACM has an openvpn server on the router Minas (10/9/2022, 5:54:02 PM): it's supported out of the box Minas (10/9/2022, 5:54:06 PM): it's not a pass-through Jeziah May L (10/9/2022, 5:54:07 PM): it is a vpn passthrough the WRT3200 Jeziah May L (10/9/2022, 5:54:21 PM): what is the problem are you getting Minas (10/9/2022, 5:54:35 PM): https://www.linksys.com/support-article?articleNum=270535 Minas (10/9/2022, 5:54:41 PM): you can check how to set up the vpn here Minas (10/9/2022, 5:54:54 PM): i am getting an expired certificate error when the client connects Jeziah May L (10/9/2022, 5:55:09 PM): let me see what we can do for this concern you have hold on Jeziah May L (10/9/2022, 5:56:00 PM): If you do not have an .ovpn file or account credentials, you need to contact the administrator of the OpenVPN server. If you are the admin of your server, contact OpenVPN. Minas (10/9/2022, 5:57:34 PM): https://forums.openvpn.net/viewtopic.php?t=32568 Minas (10/9/2022, 5:57:43 PM): Jeziah you are not getting it Minas (10/9/2022, 5:57:52 PM): i am the administrator Minas (10/9/2022, 5:57:54 PM): i own the router Minas (10/9/2022, 5:58:04 PM): i enabled the server through the router's interface Jeziah May L (10/9/2022, 5:58:12 PM): oh i see Jeziah May L (10/9/2022, 5:58:18 PM): im reading your messages Minas (10/9/2022, 5:58:47 PM): this router is one of the very few linksys routers that support openvpn server out of the box Minas (10/9/2022, 5:58:51 PM): are we clear so far? Jeziah May L (10/9/2022, 5:59:08 PM): Yes I understand Minas (10/9/2022, 5:59:11 PM): great Jeziah May L (10/9/2022, 5:59:24 PM): that is the only router yes that supports openvpn Minas (10/9/2022, 5:59:36 PM): now, it seems that the certificates on the server (inside the router) have expired Minas (10/9/2022, 5:59:46 PM): there are no instructions from linksys on how to update them Minas (10/9/2022, 5:59:55 PM): and there's no information available online Jeziah May L (10/9/2022, 5:59:57 PM): I would like to know when did you get the error? was that opebVPN server works before? Minas (10/9/2022, 6:00:15 PM): it was working fine till yesterday. today i cannot connect after 5+ years Minas (10/9/2022, 6:00:25 PM): https://forums.openvpn.net/viewtopic.php?t=32568 Minas (10/9/2022, 6:00:55 PM): there's this thread on openvpn. it explains what to do when the certificates expire. but obviously, it's no help for me as those instructions aren't meant for linksys routers Minas (10/9/2022, 6:02:15 PM): when i enabled the server 4-5 years ago, apparently those certificates that got issued within the router had an expiration date. i assume that not even linksys was aware of that. now, 5 years later, those certificates expired. and i cannot connect to my router. Jeziah May L (10/9/2022, 6:02:35 PM): Alright, we would like to know if you have gone some changes lately on your router? Minas (10/9/2022, 6:02:39 PM): nothing Minas (10/9/2022, 6:02:49 PM): and i am running the latest firmware Jeziah May L (10/9/2022, 6:03:08 PM): have you been able to configure VPN right? Minas (10/9/2022, 6:03:12 PM): yes Jeziah May L (10/9/2022, 6:03:15 PM): your problem is just the devices? Minas (10/9/2022, 6:03:20 PM): everything was working fine for the past 5 years Jeziah May L (10/9/2022, 6:03:21 PM): client devices? Minas (10/9/2022, 6:03:26 PM): today none of my devices/clients work Jeziah May L (10/9/2022, 6:03:32 PM): copy Jeziah May L (10/9/2022, 6:03:38 PM): one moment Minas (10/9/2022, 6:03:39 PM): because the certificate (on the server) has expired Jeziah May L (10/9/2022, 6:05:12 PM): alright Minas (10/9/2022, 6:05:34 PM): ⏎[Oct 9, 2022, 18:04:24] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed ⏎[Oct 9, 2022, 18:04:24] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed⏎[Oct 9, 2022, 18:04:24] EVENT: DISCONNECTED ⏎[Oct 9, 2022, 18:04:25] Raw stats on disconnect: BYTES_IN : 2365 BYTES_OUT : 339 PACKETS_IN : 4 PACKETS_OUT : 3 SSL_ERROR : 1 CERT_VERIFY_FAIL : 1 Jeziah May L (10/9/2022, 6:05:35 PM): let us see what we can recommend for that since issue is with the devices Minas (10/9/2022, 6:05:59 PM): this is the error i get - because it cannot verify the certificate Minas (10/9/2022, 6:07:01 PM): openvpn on the mac says: Connection Failed. There was an error attempting to connect to the selected server. Error message: Peer certificate verification failure. Minas (10/9/2022, 6:07:17 PM): if you google this, the first thread you get is the one i shared with you Jeziah May L (10/9/2022, 6:07:26 PM): I got you Minas (10/9/2022, 6:07:26 PM): https://forums.openvpn.net/viewtopic.php?t=32568 Jeziah May L (10/9/2022, 6:07:29 PM): hold on Minas (10/9/2022, 6:07:32 PM): thanks Minas (10/9/2022, 6:08:35 PM): 2nd page describes the actual problem and the solution Jeziah May L (10/9/2022, 6:09:33 PM): alright one moment Jeziah May L (10/9/2022, 6:11:17 PM): https://www.linksys.com/support-article?articleNum=157327 have you tried this one? Minas (10/9/2022, 6:12:04 PM): obviously, these are the instructions on how to setup the server and the clients Minas (10/9/2022, 6:12:19 PM): i wouldn't be using the server for 5 years now hadn't i done this Jeziah May L (10/9/2022, 6:12:32 PM): and after that you are still getting the error? Minas (10/9/2022, 6:12:44 PM): i don't think you understand me man Minas (10/9/2022, 6:12:59 PM): the instructions you shared are not the solution to my problem Minas (10/9/2022, 6:13:08 PM): they are the generic instructions to set up the server Minas (10/9/2022, 6:13:13 PM): i've done this, 5 years ago Minas (10/9/2022, 6:13:20 PM): and was working fine till today Minas (10/9/2022, 6:13:40 PM): can you please escalate this to someone more senior? Jeziah May L (10/9/2022, 6:14:06 PM): can you hold on sir? we are doing our best to assist you with this Jeziah May L (10/9/2022, 6:14:16 PM): we understand your concern Minas (10/9/2022, 6:14:20 PM): yes but you are not listening to me Minas (10/9/2022, 6:14:25 PM): we keep spinning around the same thing Minas (10/9/2022, 6:14:31 PM): i pinpointed the exact issue Jeziah May L (10/9/2022, 6:14:38 PM): I understand Minas (10/9/2022, 6:14:40 PM): i am telling you exactly what's wrong Minas (10/9/2022, 6:14:45 PM): and you are sending me generic instructions Minas (10/9/2022, 6:14:53 PM): please escalate it Jeziah May L (10/9/2022, 6:15:54 PM): let me see what we can do thanks Minas (10/9/2022, 6:16:05 PM): thanks Jeziah May L (10/9/2022, 6:17:50 PM): alright Jeziah May L (10/9/2022, 6:26:01 PM): hello sir/maam , we apologize for the inconvenience this may have caused you. Since you have configured the VPN and as you have said it was working fine for 5 years and all of a sudden it stopped. What linksys do is to configure the VPN, making sure the username and password is correct you have is correct. Beyond that about the certification error you are getting , we will advised you to contact openvpn.net Minas (10/9/2022, 6:26:33 PM): this is an issue with the router, openvpn will ask me to contact linksys Minas (10/9/2022, 6:26:38 PM): within* Minas (10/9/2022, 6:27:11 PM): if you fail to realize what the issue is, you will keep giving me wrong advise Minas (10/9/2022, 6:27:35 PM): linksys build a router that supports openvpn server Minas (10/9/2022, 6:27:52 PM): they didnt say "buy this router, and when you have issues with openvpn, contact them" Minas (10/9/2022, 6:29:12 PM): the openvpn code that linksys added to this router to support openvpn server, clearly is not MAINTANTED through firmware updates. if there are dependencies that need to be updated WITHIN the router, this is linksys responsibility, not openvpn Jeziah May L (10/9/2022, 6:29:46 PM): sir there is a 3rd party involve for this and we have no visibility on where to check or get the update of certificate since that is the issue you were having right now and the only way we can figure it out is to contact openvpn Minas (10/9/2022, 6:30:43 PM): this is why it needs to be escalated to the engineering team withing linksys that enabled openvpn server for this router Minas (10/9/2022, 6:30:59 PM): i don't expect you to have a solution to this Minas (10/9/2022, 6:31:07 PM): i expect you to escalate it to the concerned team Jeziah May L (10/9/2022, 6:31:40 PM): we will raise this concern you have sir Minas (10/9/2022, 6:31:54 PM): this is not a concern. this is a problem i am facing. Minas (10/9/2022, 6:32:10 PM): and i need you to raise a ticket so we can have proper follow up Jeziah May L (10/9/2022, 6:32:20 PM): for now what we can do is for you to contact openvpn.net and if they will advised you to contact us back then we can provide you a case number Jeziah May L (10/9/2022, 6:32:44 PM): yes we can give you a ticket / case number 15120913 Minas (10/9/2022, 6:32:52 PM): I will open a ticket with them now Jeziah May L (10/9/2022, 6:33:10 PM): we apologize for the inconvenience this may have caused you Minas (10/9/2022, 6:33:22 PM): how can i follow up to the case number? Minas (10/9/2022, 6:33:32 PM): i just come to the chat here and give it to the agent? Jeziah May L (10/9/2022, 6:33:53 PM): just provide it to the next agent or call us with this hotline number 1-800-326-7114 Minas (10/9/2022, 6:34:01 PM): thank you, Jenziah Jeziah May L (10/9/2022, 6:34:42 PM): We apologize once again Minas but thank you for your feed back and for addressing your concern Jeziah May L (10/9/2022, 6:35:24 PM): Should you need further assistance with your Linksys device, feel free to chat with us again anytime. We are at your service 24/7 or call our hotline : 800-326-7114 Thank you for the opportunity to serve you through Live Chat for Linksys Products.

Hello apn3a, The problem is obvious. The certificate is expired. OpenVPN can work with certificates so that the client can verify the identity of the server, and the server can verify the identity of the client. OpenVPN just takes the certificates you feed it and uses them. It checks them, it does server and client verification with them, but it does not generate them or alter them. You as the server administrator are responsible for providing correct certificates. In this case that would be you. The theory is that when you set up your OpenVPN server you provide your server and your clients with a pair of private key and public certificate. And you need to make a certificate authority that will sign the server and client certificates. The clients and server can verify that they are signed by the certificate authority. The idea here is that someone with the right privileges that has control over the certificate authority can sign client and server certificates, so that only those that are signed by this same certificate authority can be used to connect to your OpenVPN server. There are additional verification options such as certificate revocation list, username/password authentication, checking X509 properties, and so on, but those are not relevant for the problem at hand. The thing is, all the certificates generated have a start date and an end date. Your information shows that this certificate is clearly outside of those boundaries, and will therefore fail verification because of that single fact: Not Before: Oct 11 06:00:52 2012 GMT Not After : Oct 9 06:00:52 2022 GMT I also want to point out that 1024 bit certificates are outdated and should be replaced with at least 2048 bit or perhaps better to use elliptic curve secp384r1. So for that reason alone I would want to recommend to wipe your certificate infrastructure and start over, on top of the issue you're facing now. In the case of your Linksys router however I do not know if you have the necessary access or privileges to actually do this. I do not own a Linksys device and do not know how they have implemented the creation of a certificate authority and the necessary server and client certificates. I would suggest to look in your Linksys router if there is any option at all to replace the certificates. You're basically looking for a way now to reach into the Linksys router and get those expired certificates out and replace them, and to also replace the client certificates as well. So all the current connection configurations on the VPN clients need to be replaced as well so they get new certificates required to connect. Unfortunately I do not have a Linksys router and therefore have no idea if this is possible or not using the web interface. For that I am afraid I have to direct you back to Linksys. Perhaps there is a way to get SSH or console access to the Linksys router so that you can go into the filesystem and replace the certificates yourself? Or perhaps Linksys has some commands you can run to wipe the old certificates and generate new ones from scratch on the router itself? Basically the question that needs to be asked of Linksys is; How can I replace the expired certificates that are in my Linksys router and are used for OpenVPN? Hopefully they'll have an answer. Good luck. Johan

Hey apn3a, Since we have 2 reports about the same issue I would like to examine the CA certificate that you are using on your Linksys router. But only the public portion of it, which is safe to give out. The public portion is used by the client to verify the identity of the server, but doesn't contain anything that should remain private. To be clear, other items like private keys and such should remain private as they're part of the security of making a VPN connection, but the CA public portion is one that can be freely distributed to anyone without security risk. There are two ways client connection files are presented to users - as a set of separate files, in which case the file called "ca.crt" or "ca.pem" or such will be the file I'm looking for (and definitely NOT client.crt or client.key). If you get 1 file that has the certificates embedded I'm looking for the portion between and (and definitely not or ). I would like to get this certificate file from both you and the other guy experiencing the same issue, and compare the two. If there are similarities between them it might mean that Linksys has done a very bad thing in terms of security. And I hope I'm wrong about it but I want to verify anyway. I'd really appreciate if you could help me in my investigation and send me that CA certificate file. The best way to send it is at https://openvpn.net/support by registering on our main website (it's free) and sending in a support ticket and referencing this forum post - that way it's sent via a secure channel and I'll receive it there. I hope you'll help me investigate this situation further, Kind regards, Johan

Hello, I have a similar problem with linksys wrt3200 from yesterday problems with the certificate validity, in the vpn profile a certificate valid until 2031, the client receives a message about an invalid certificate

Hello, I have received the same error today as well, and it seems that everyone with this router will receive the same. Linksys Support says that with this being 3rd party software that we need to direct this to your support team. When I went to your support last night, I was told that I need a paid account for me to receive help here. I have signed up for a free account under tssbilling@gmail.com, but further assistance is needed. I'll share the public certificate here with you. -----BEGIN CERTIFICATE----- MIID9zCCA2CgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBlzELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAkNBMQ8wDQYDVQQHEwZJcnZpbmUxEDAOBgNVBAoTB0xpbmtzeXMx DzANBgNVBAsTBkJlbGtpbjEOMAwGA1UEAxMFTWFtYmExEzARBgNVBCkTCkJsYWNr TWFtYmExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRAbGlua3N5cy5jb20wHhcNMTIx MDExMDYwMDUwWhcNMjIxMDA5MDYwMDUwWjCBmDELMAkGA1UEBhMCVVMxCzAJBgNV BAgTAkNBMQ8wDQYDVQQHEwZJcnZpbmUxEDAOBgNVBAoTB0xpbmtzeXMxDzANBgNV BAsTBkJlbGtpbjEPMA0GA1UEAxMGY2xpZW50MRMwEQYDVQQpEwpCbGFja01hbWJh MSIwIAYJKoZIhvcNAQkBFhNzdXBwb3J0QGxpbmtzeXMuY29tMIGfMA0GCSqGSIb3 DQEBAQUAA4GNADCBiQKBgQCn3onfPsTQnqlK+LR3cz7cPvk952Ow8E9R9fBo7Lhs 8IHDkRZ/qSg3R57nOcCHWpYsNNAMMXMVmUs2GqE8PSpAWDMbY6XLsFYhT39sfW1N WpAFTc/wdt3WXN47sCMmk6uwj/a9jYEbe6an5Rh05EfSpI939RUXWQZfE0UYWAb4 rQIDAQABo4IBTjCCAUowCQYDVR0TBAIwADAtBglghkgBhvhCAQ0EIBYeRWFzeS1S U0EgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRXSFqmkgK7QKsDlelb b7zvq458kzCBzAYDVR0jBIHEMIHBgBTggnnoFe7nI8GvHmcjgfFZUA9CTKGBnaSB mjCBlzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQ8wDQYDVQQHEwZJcnZpbmUx EDAOBgNVBAoTB0xpbmtzeXMxDzANBgNVBAsTBkJlbGtpbjEOMAwGA1UEAxMFTWFt YmExEzARBgNVBCkTCkJsYWNrTWFtYmExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA bGlua3N5cy5jb22CCQDpIJqCdz4H8jATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNV HQ8EBAMCB4AwDQYJKoZIhvcNAQEFBQADgYEAMfFON2WzXP7wUcVCBsAtaP8P0gA4 BIun7SZ+43dmXY+U+kG3rYHZE4OL9G7Al0nf7sZsHHjsg8ozUHd/rCIQLsoRaLry 5VQbNIcWG/BH5AOFfnho0ZULZhV8hIyndzjtwtvYjCHXPauT9t0TRYTafIh691Ve 3x0gWDXep0x2k+U= -----END CERTIFICATE----- This way, you can see that it very clearly expires on October 8th... Looking inside the .opvn file, I can see that it has the following: Validity Not Before: Oct 11 06:00:50 2012 GMT Not After : Oct 9 06:00:50 2022 GMT

Hello Arti82, When checking certificates all the certificates must pass. That means the CA certificate itself must pass the validity check, the client certificate must also pass the validity check, and finaly the server certificate too. It is possible that the client certificate was generated with an expiration date in 2031 while the CA certificate expired on October 9th 2022. You can examine each certificate individually to see what the status of each is. If even one of them is expired, the verification will fail because of that. Currently I am collecting information on Linksys router certificate implementation to confirm some of my suspicions. Kind regards, Johan

[quote=Arti82 post_id=108941 time=1665410549 user_id=58097] Hello, I have a similar problem with linksys wrt3200 from yesterday problems with the certificate validity, in the vpn profile a certificate valid until 2031, the client receives a message about an invalid certificate [/quote] If you've changed it manually in the .opvn file, it actually still needs to be part of what is encoded. If you look at the similar portion of what I posted and bring it to sslshopper, https://www.sslshopper.com/certificate-decoder.html, you can see the true details of the cert portion of the file.

Thanks for the post John. I too saw the saw issue starting yesterday and the certificate indicated it did not expiry until 2028... I have via a support ticket uploaded the portion of the certificate you were looking for. Hope it helps. Regards Chris.

[quote=openvpn_inc post_id=108944 time=1665410968 user_id=52935] Hello Arti82, When checking certificates all the certificates must pass. That means the CA certificate itself must pass the validity check, the client certificate must also pass the validity check, and finaly the server certificate too. It is possible that the client certificate was generated with an expiration date in 2031 while the CA certificate expired on October 9th 2022. You can examine each certificate individually to see what the status of each is. If even one of them is expired, the verification will fail because of that. Currently I am collecting information on Linksys router certificate implementation to confirm some of my suspicions. Kind regards, Johan [/quote] Hi Johan, Would you be able to provide us the correct file(s) to resolve this issue, or is that even possible with the type of configuration we have here?

[Linksys] Error message: Peer certificate verification failure

andrej.poljak

HI,

here are info of certs

CA cert
Certificate Information:
Common Name: Mamba
Organization: Linksys
Organization Unit: Belkin
Locality: Irvine
State: CA
Country: US
Valid From: November 19, 2022
Valid To: November 16, 2032
Issuer: Mamba, Linksys
Serial Number: ***************************

client cert
Certificate Information:
Common Name: client
Organization: Linksys
Organization Unit: Belkin
Locality: Irvine
State: CA
Country: US
Valid From: November 19, 2022
Valid To: November 16, 2032
Issuer: Mamba, Linksys
Serial Number: ***************************

BR,
Andrej

jaakdaniels

Same here, even the dates. So you also generated them yesterday?
Time of mine is:

CA:
Not Before: Nov 19 14:21:47 2022 GMT
Not After : Nov 16 14:21:47 2032 GMT
Server:
Not Before: Nov 19 14:21:48 2022 GMT
Not After : Nov 16 14:21:48 2032 GMT

steven424

What concerns me about all the solutions that claim the certs are created the first time the router is turned on or after a hard reset, is that the begin and end times of just about every set of "Not Before / Not After" dates posted here are almost identical. If the certs are really dynamically created during an initialization, then the pairs of start/stop dates would be all over the map.

But they're not, which leads me to believe that the certs are baked into the firmware and only a new firmware update will deliver an up-to-date pair of certs. Those who were able to generate certs that expire in 2032, maybe you have a very early or very late 1.0.8 firmware version that most of us don't have.

Regardless, most owners do not have the level of technical knowledge and sophistication to perform most of the solutions posted in this forum. IMHO it is incumbent upon Linksys to provide an updated firmware file (1.0.9?) that is simply load-and-go, and recover its good name as a leader in high-end routers. I wonder what users who purchase a WRT3200ACM today are going to do when they discover the VPN feature is not working out of the box.

--- Steve

jaakdaniels

Hi Steve,

Linksys is expected to post an update next week. They should have a beta-release of the firmware. Currently the latest version is 1.0.8.199531.
Meanwhile i don't want to wait and searched for a workaround that kept me the certificates of the VPN valid.

You're probably right that most people do not have the technical knowledge, but hey, we do what we can, no?

Did you try my routine yet? I'ts easy! Just download the old SW, install it and let it reboot. Then press reset for 20 sec. with the red button and let it boot. After it has been fully booted, flip the power switch 3 times so it goed back to the first partition. When you switch it on for the 4th time, it should update the certificates with a validity up to 2032.

Regards, Jaak

ldm314

jaakdaniels wrote Hi Andrej,

Thank you for your contribution. Had the same procedure but was not successfull every time. The difference was that i was not so patiently to wait 5 minutes... The question is, in logging you see the Router resetting the RTC to Jan 01, 1970. So it had no clue of time at boot moment and can only retrieve time from the internet. This happens at nearly the same time as te certificates are generated, so it's a timing issue from Linksys. They need to retrieve time and generate certificates AFTER the NTP-time is acquired.
I guess you were lucky, like i was only one time. Don't press that reset button again mate! 🙂

After 7 days of testing almost everything it seems i have a stable solution, at least, it worked 2 times in a row... 🙂
Almost everybody has FW 1.0.8.199531 installed. Me 2. So i thought, why not going to the time things DID work. After all, the definition of an upgrade/update is solve the known bugs and add unknown bugs...

So this is my procedure that worked twice in a row:

- I downgraded to FW version 1.0.5.175944 and gave the router a factory reset. You can find the FW here
(Details: I flashed both partitions with the serial cable in uBoot, but i asume it should also work downgrading just 1 partition)
- Let it boot and log in at 192.168.1.1 (I normally use Google Chrome, but this old FW only worked on the old Internet Explorer)
- Make a VPN profile and download the certificate. Check it at https://www.sslshopper.com/certificate-decoder.html
- The certificate should be valid until Dec 1, 2023
- If this is the case, restore the "older" software. You can do this in the firmware update menu or switch the router 3 times on and off for about 3 seconds. The 4th time the router will switch to FW 1.0.8.199531 again and generate new certificates valid until 2032

Good luck!

So I ran into this same thing today preparing to work remotely for the holiday. I've tried a couple hours now with the suggestions in this thread with no luck. With WAN and WPS button, waiting 5 minutes before WAN etc... all failed.

I don't have a serial cable setup to update firmware. I downloaded this old firmware, used the web interface to apply it, the result is a boot failure. After a few power cycles it goes back to 199531. This is with a 3200ACM.

andrej.poljak

Hi Steve,

you can also try my scenario. It is may be more easy or Jaak's.

Scenario:
1. remove all UTP cables from all ports (WAN and LANs)
2. connect PC to LAN1, PC must has config the NIC card to get IP through DHCP
3. make hard reset, pushing red mini button for 20 seconds
4. wait 2 minutes to reboot route
5. login to router (192.168.1.1), use manual configuration, press IGNORE button when wizard tell you that you are not on internet
6. use "admin" password to login
7. wait to finish wizard and finishing login to the router
8. wait for 1-2 minutes
9. connect cable to WAN port, and now this is important, on WAN cable you must have internet
if you use PPPoE connection, than configure your ISP modem to make PPPoE session first, than
connect WAN cable. Then wait for a while to get modem correct date/time, you can check in
troubleshooting/report options, you can see router time and browser time
10. than go to OpenVPN options, create one user; username/password/save
11. not start OpenVPN server, but download .ovpn file
12. with link https://www.sslshopper.com/certificate-decoder.html you can check cert
or copy content of first and then second into file with filename cert.cer and then
open it with windows file explorer, and you can see info of certificate.

If you have WAN cable connected when making reset, the router reset, and at
start it detect WAN connection for a moment, and in this time router has
stored date in year 2012 and also certificate is create.

So important, not connect to WAN when making hard reset. Login in without WAN connection.
Wait for a while, connect to WAN cable with internet "signal", wait for a while to router get
right date/time, then configure OpenVPN.

I think certs are not baked into the firmware, but time and date are banked.
So Linksys guy must only make new firmware with new starting date/time, ex. 2022/11/11 12:00.

BR,
Andrej

Jaws

Well, I would like to know that Linksys would update the firmware for this line of routers to correct the out of date certificates. Can anyone verify there will be a new firmware update soon? I would wait for it rather than jumping through these hoops to generate a new certificate.

WRT3200ACM owner John.

jaakdaniels

Wombatus wrote this on another page of this forum:
"Further to this, I was just notified by Belkin (Linksys support) that a beta fix will be released next week for the 3200ACM routers."
That would be THIS week...

andrej.poljak

Hi,

Yes this is a "hard" work. Only put in firmware new default start date and time, and that is all. But they need
guy who can do these, I hope they have someone.

But as I say, you can make
backup
hard reset without cable in WAN port
wait to reboot
login with PC connected on LAN port (use admin as password) 192.168.1.1
use local connection mode, not some Smart Linksys mode
ignore message "router can not access internet"
wait to finish loading GUI of the router
connect WAN port, this cable must have internet
define one VPN user
download ovpn file, and check CA and client certificate
restore old settings

On my side works without any problems.

BR,
Andrej

jaakdaniels

Andrej, did you manage to reproduce this result or happened it just once? If i have to guess it happened only once? I also managed it once but could not reproduce it because the only moment the router sets the time, is after you plug in the wan cable. Once you have wan-connection the certificates are generated. Timings vary.

andrej.poljak

Hi,

yes, I tried everything, and at the last attempt with upper scenario
I got good certificate, and then I not touch anything else :-)

Now works. I also deactivate auto download new firmware.

BR,
Andrej

p.s.
and yes, you can be right about WAN. The router has some old default date/time
and with connect to WAN (must be on interne), router get with NTP servers
the correct date/time, but when certificate create, hm hm, if after
this is OK, if before then not OK , old date/time.

p.p.s
I non-stop ping 8.8.8.8 and 192.168.1.1
WAN and on LAN connected
Make hard reset
IP 8.8.8.8 and 192.168.1.1 was down
When route reboot, IP 192.168.1.1 start ping, but not 8.8.8.8
wait some time, login in, and use local, manual setup/login, and
between this action 8.8.8.8 start ping, so WAN port is on with
first login, and certificate is not good, because between rebooting
I have connected router to WAN. At last attempt I made exact the same,
but no WAN connect. WAN connected latter.

nico_ar

Hi everybody
Finally Linksys have fixed this issue after releasing the beta 1.0.9.211585. After update a factory reset is required and a fresh new install, otherwise it won't work. I do not know if the beta is already uploaded on their official site. Meanwhile, if someone is interested, I can share the link at request.
Have a nice day!

Pippin

Hi,

There is already a link shared on this forum:
https://forums.openvpn.net/viewtopic.php?t=34892&start=40#p109664

As noted there, be cautious or just wait till it's officially available for download.
.

Solarstar

What about firmware for the WRT1900ACv2? It is doubtful there will be any new firmware for the 1900.

I tried the listed work arounds with very mixed results and no valid certs yet. My issue is complicated because I have to setup PPPoE to get a WAN connect to NTP Servers. I have waited 5 mins before touching the OPEN GUI.

1st - I flashed back to firmware 2.0.7.x and had a valid cert but powered off to connected back 2 USB hard drives. When I power back on and restored firmware to 2.0.8.x and restore my 11-26-2022 config. The clientconfig.ovpn file was blank at 1KB vs the usual 6.8K file. It was pretty disappointing, I was close.

2nd - Ran through the factory reset steps again on 2.0.8.x. However, the <ca> is Oct 2012 but the <cert> is Dec 2023.

milos.vanco

I am happy to confirm I was able to generate a valid OpenVPN certificate that works and has expiration set to 2032 using this procedure on my WRT1900ACS router. Thanks Andrej

andrej.poljak wrote Hi Steve,

you can also try my scenario. It is may be more easy or Jaak's.

Jaws

I too did the process stated above and got a new date on my certificate from 2022 to 2032. I try to connect using a valid certificate and still get a failure notice.

Here is the error from the open vpn log file.

⏎[Dec 8, 2022, 19:15:33] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
⏎[Dec 8, 2022, 19:15:33] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed⏎[Dec 8, 2022, 19:15:33] EVENT: DISCONNECTED ⏎[Dec 8, 2022, 19:15:36] Raw stats on disconnect:
BYTES_IN : 2365
BYTES_OUT : 339
PACKETS_IN : 4
PACKETS_OUT : 3
SSL_ERROR : 1
CERT_VERIFY_FAIL : 1

⏎[Dec 8, 2022, 19:15:36] Performance stats on disconnect:
CPU usage (microseconds): 2737936
Network bytes per CPU second: 987
Tunnel bytes per CPU second: 0

andrej.poljak

Jaws wrote I too did the process stated above and got a new date on my certificate from 2022 to 2032. I try to connect using a valid certificate and still get a failure notice.

Here is the error from the open vpn log file.

⏎[Dec 8, 2022, 19:15:33] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
⏎[Dec 8, 2022, 19:15:33] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=7040 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed⏎[Dec 8, 2022, 19:15:33] EVENT: DISCONNECTED ⏎[Dec 8, 2022, 19:15:36] Raw stats on disconnect:
BYTES_IN : 2365
BYTES_OUT : 339
PACKETS_IN : 4
PACKETS_OUT : 3
SSL_ERROR : 1
CERT_VERIFY_FAIL : 1

⏎[Dec 8, 2022, 19:15:36] Performance stats on disconnect:
CPU usage (microseconds): 2737936
Network bytes per CPU second: 987
Tunnel bytes per CPU second: 0

Hi,
so you download new .ovpn file from router. Open with Notepad++ this file.
You will see two times
-----BEGIN CERTIFICATE-----
:
:
:
:
-----END CERTIFICATE-----

first is CA and second is client certificate. OK.
Now copy form first from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- (include also these two lines)
Go to link https://www.sslshopper.com/certificate-decoder.html
Paste content to window- At the bottom you can see info, date ......
First and the second must have 'Valid to': 2023 ..............

Jaws

Hi,
so you download new .ovpn file from router. Open with Notepad++ this file.
You will see two times
-----BEGIN CERTIFICATE-----
:
:
:
:
-----END CERTIFICATE-----

first is CA and second is client certificate. OK.
Now copy form first from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- (include also these two lines)
Go to link https://www.sslshopper.com/certificate-decoder.html
Paste content to window- At the bottom you can see info, date ......
First and the second must have 'Valid to': 2023 ..............

[/quote]

Ok I did this and it says the following
Valid From: October 10, 2012
Valid To: October 8, 2022

So the certificate is still invalid but inside the client certificate there is a line that says the following

Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=CA, L=Irvine, O=Linksys, OU=Belkin, CN=Mamba/name=BlackMamba/emailAddress=support@linksys.com
Validity
Not Before: Dec 3 16:30:31 2022 GMT
Not After : Nov 30 16:30:31 2032 GMT

These dates are what changed for me when I had reset the router. Am I missing a step?

Jaws

I have also noticed there are 3 certificates inside the clientconfig.ovpn file. The is the first one that has <ca> BEGIN CERTIFICATE -- to END CERTIFICATE </ca>
Then another several lines down that has ---BEGIN CERTIFICATE to END CERTIFICATE ---
Then a final one that is --- BEGIN PRIVATE KEY --- to END PRIVATE Key

I use the link for the first key and is says it is valid from Valid From: October 10, 2012
Valid To: October 8, 2022.

When I enter the second key is says it is Valid From: December 3, 2022
Valid To: November 30, 2032.

Is it possible that they router is generating two keys now?

andrej.poljak

Hi,

yes, you are right.
First is CA, second is client cert, and last is private key.

And I had also the same issue as you, but when I try few times more,
I got also the CA valid to 2023. So try and hope, and test the
first certificate (CA), because you can not see valid info in file, you
must use the https:\....... link, in file you see valid info for client cert.

BR,
Andrej

« Previous Page Next Page »