CA file got corrupted.. please help!

basil1987

:oops: While trying to create an additional client certificate, my CA certificate on server got corrupted.. Now if I generate a new client certificate, client is not able to connect and its showing the following error.

Sat Aug 20 14:42:07 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Sat Aug 20 14:42:07 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 20 14:42:07 2011 LZO compression initialized
Sat Aug 20 14:42:07 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Aug 20 14:42:07 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Aug 20 14:42:07 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 20 14:42:07 2011 Local Options hash (VER=V4): '41690919'
Sat Aug 20 14:42:07 2011 Expected Remote Options hash (VER=V4): '530fdded'
Sat Aug 20 14:42:07 2011 UDPv4 link local: [undef]
Sat Aug 20 14:42:07 2011 UDPv4 link remote: IP_HERE:Port_here
Sat Aug 20 14:42:08 2011 TLS: Initial packet from IP_HERE:Port, sid=762f7ec0 4c5bfd4b
Sat Aug 20 14:42:09 2011 VERIFY OK: depth=1, /C=SE/ST=N/A/L=Stockholm/O=ClickBase_Corp_Sverige_AB/CN=prod1.touchguide.se-CA/emailAddress=support@touchguide.se
Sat Aug 20 14:42:09 2011 VERIFY OK: nsCertType=SERVER
Sat Aug 20 14:42:09 2011 VERIFY OK: depth=0, /C=SE/ST=N/A/O=ClickBase_Corp_Sverige_AB/CN=server/emailAddress=myemail
Sat Aug 20 14:43:07 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 20 14:43:07 2011 TLS Error: TLS handshake failed
Sat Aug 20 14:43:07 2011 TCP/UDP: Closing socket
Sat Aug 20 14:43:07 2011 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug 20 14:43:07 2011 Restart pause, 2 second(s)
Sat Aug 20 14:43:09 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 20 14:43:09 2011 Re-using SSL/TLS context

All my existing clients are still able to connect. The problem is only with newly generated keys.

I tried to restore the ca.crt file with ca.crt file from one of my clients (I guess ca.crt is common for all clients and server), but that didn't work either. If I replace the ca.crt file using client ca certificate, I am getting following error while generating new client certs.

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
CA certificate and CA private key do not match
10192:error:0B080074:x509 certificate routines:X509_check_private_key:key values
mismatch:.\crypto\x509\x509_cmp.c:406:
unable to write 'random state'
Could Not Find C:\Program Files\OpenVPN\easy-rsa\keys\*.old

This is making problems with business. Could someone please shed some lights on it..? I tried searching through the forums but I didn't find any helpful pages.

Thanks
Basil

janjust

this is a PKI problem, really; it seems your ca.key file got corrupted and you ended up with a NEW ca.crt+.ca.key file; all client certs created from now on will be signed by the new ca.crt file. It IS possible to use both the old ca.crt and new ca.crt files on the same server configuration.

Before you go that route, however, check the server and client log files more carefully. The message

Sat Aug 20 14:42:09 2011 VERIFY OK: depth=1, /C=SE/ST=N/A/L=Stockholm/O=ClickBase_Co ... chguide.se
Sat Aug 20 14:42:09 2011 VERIFY OK: nsCertType=SERVER
Sat Aug 20 14:42:09 2011 VERIFY OK: depth=0, /C=SE/ST=N/A/O=ClickBase_Corp_Sverige_AB/CN=server/emailAddress=myemail
Sat Aug 20 14:43:07 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 20 14:43:07 2011 TLS Error: TLS handshake failed

shows that the client accepts the server cert, but the connection is not established. Does the server log show that the client cert is rejected? or is a firewall blocking access?