openssl is not recognized as an internal or external error

[asus_pulyups]

Hi,

I am trying to configure the latest version of OpenVPN 2.3.2 on my Asus RT-N66U running Merlin firmware.

I have searched and found several guides that refer to earlier versions like:
http://www.howtogeek.com/60774/connect- ... nd-tomato/

and

http://www.yasti.be/?p=149

I have also searched this form and found out that easy-rsa is no longer a part of the installer:

topic12096.html

So I got the easy-rsa master from here:
https://github.com/OpenVPN/easy-rsa

I see the readme section provides some notes on how to install - but I am getting stuck and need help. Here are some questions -
1. from the easy-rsa master folder what do I need as a windows user? Is the 1.0 and 2.0 Linux code (sorry for being a newbie)?

Here are some things I did -
1) copied the "windows" folder contents from the easy-rsa master folder I downloaded into Program Files\OpenVPN\easy-rsa
2. copied the openssl-1.0.0.cnf from the 2.0 folder in the master package to Program Files\OpenVPN\easy-rsa
3. I manually created a "vars" and "keys" folder in Program Files\OpenVPN\easy-rsa
4. I then copied the index.txt and serial.start to the new keys folder.
5. I tried following the from the readme file included in the windows folder in the Master file including editing the vars.bat file to the correct parameters including the changing the folder names -

@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.

set HOME=C:\PROGRA~1\OpenVPN\easy-rsa
set KEY_CONFIG=openssl-1.0.0.cnf

rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=C:\PROGRA~1\OpenVPN\easy-rsa\keys

rem Increase this to 2048 if you
rem are paranoid. This will slow
rem down TLS negotiation performance
rem as well as the one-time DH parms
rem generation process.
set KEY_SIZE=2048

I get the error - 'openssl' is not recognized as an internal or external command, operable program or batch file.

I get the impression it cannot find the file - what am I doing wrong? I am running windows 7 64bit.

Thanks in advance.

[asus_pulyups]

also - this may be old news -

but I had read the 'init-config' command was supposed to copy vars.bat and openssl.cnf into the easy-rsa folder. The first worked, but the openssl.cnf was not created, hence while I copied it manually. not sure if I should use the file from the 1.0 or 2.0 directly. I assume 2.0 represents the version of OpenVPN client software.

thanks in advance

[asus_pulyups]

"I get the error - 'openssl' is not recognized as an internal or external command, operable program or batch file"

I get this error when I run the build-ca command. Can someone help?

Tom

[dagjoar]

I am having the same problem. Running OpenVPN 2.3.2 on Windows Server 2008 R2.

Where is the openssl executable meant to be located? I cannot find it anywhere in my installation..

[dj@dagjoar.com]

Just wanted to add to my previous post that I am running the 64-bit version of Windows Server 2008 R2

[dj@dagjoar.com]

I have it working now. All I did was install OpenSSL separately by downloading it from http://slproweb.com/products/Win32OpenSSL.html. (It also asked me to install VC++ 2008 Redistributable, which I did)

Then I included the openssl bin directory in my system PATH.

[jg]

i have t same problem you had. i also downloaded installed the openssl separately. but i dont know (newbie) how to " include the openssl bin directory in my system PATH." how is it?

thanks.

[dbest1010]

I have the same problem also. i am running on a netbook with 32-bit windows 7 starter and a D-Link DIR-601 router (with DD-WRT firmware) as my router i am trying to setup with OpenVPN.

I found out that you do need to install OpenSSL apart from OpenVPN. Well, at least in the version of OpenVPN I installed and how (what options i selected while in the installer) i installed it (i didnt use any extra options in the installer, just the default options). (OpenVPN 2.3.2)

I found that out that because there was a "README-Windows.txt" file. And in that file this is what it says at the beginning...

Easy-RSA 3 Windows README

Easy-RSA 3 runs POSIX shell code, so use on Windows has some additional
requirements: an OpenSSL installation, and a usable shell environment.

Contents of this file:
1. OpenSSL
2. shell environment
3. Windows paths
4. Appendix:
4.1: reference links
4.2: license of included components

1. Obtaining OpenSSL for use with Easy-RSA

There are a couple of ways to do this:

(A) If you are using OpenVPN, the easiest solution is to install the OpenSSL
program components and add openvpn to the system PATH; this is offered as an
installation option as part of OpenVPN.

(B) Optionally, install an OpenSSL package, such as from the openssl.org
website (see appendix.) In this case it will be required to do one of the
following:

(1) Add the location of openssl.exe to the system PATH

(2) Define the OPENSSL env-var to reference the full path to openssl.exe

(3) Edit the vars file (copy vars.example as a starting point) as instructed
in the comments

There is more to this, but i only copy&pasted what it says from the beginning upto and including what it says about OpenSSL.

if you want a copy of the "README-Windows.txt" file. i've uploaded a copy to my GoogleSites site. you can get it here. http://sites.google.com/site/dbest1010f ... pn/openssl
(And for the people that don't want to download it, but just read it. I also copy&pasted it to the page)

If anyone has any questions, just email me. dbest1010@redpride.net

[dbest1010]

i Have Also Found This (while trying to find out how to install/where-to-place OpenSSL's files)...

Install OpenSSL on a windows machine

You can use OpenSSL on a Windows machine to to proceed some cryptographic operations (generation of a private key, of a CSR, certificate conversion...).

Access the official website: http://www.openssl.org/
Then download the "binary" program for Windows: > related > Binaries :
http://www.openssl.org/related/binaries.html

For cryptographic standard operations linked to certificates, the "Lite" version is sufficient. For certains versions of Windows (Windows 2000, windows XP...) you will have to install "Visual C++ 2008 Redistributables" as well.
Use OpenSSL on a Windows machine

The standard installation of OpenSSL under Windows is made on "C:\OpenSSL-Win32" and the executable is stored in the sub-repertory "bin". To execute the programm via the Windows xommand Prompt, provide the full path:
>C:\OpenSSL-Win32\bin\openssl ...

The version 1.0 of OpenSSL needs a "openssl.cnf" configuration file. The repertory /usr/local/openssl not being present on Windows machines, precise with the parameter -config a path to this configuration file. We provide standard files on the bottom of this page. For example:
>C:\OpenSSL-Win32\bin\openssl -config "C:\Program Files\Apache Software Foundation\Apache2.2\conf\openssl.cnf"
If you still encounter the error:
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
openssl:Error: '-config' is an invalid command.

Execute the following command first:
set OPENSSL_CONF=c:\OpenSSL-Win32\bin\openssl.cnf
Concerning the version "OpenSSL v0.9.8t Light", no need for the opens.cnf file, a default configuration will be taken into account.
To get (or renew or reissue) a certificate for Apache under Windows for example, you'll have to generate a CSR and its private key. To do so, we advise the use of our online wizard to execute the OpenSSL command with the adequate parameters.

Issues encountered on Windows while generating a CSR via one command

According to the version of OpenSSL you installed or to the the installation method on Windows, you may encounter error messages such as:

config or req is not recognized as an internal or external command
Check the syntax and the quotes when executing your command.

Unable to load config info from /usr/local/ssl/openssl.cnf
OpenSSL relies here on a Linux default arborescence.
Troubleshooting: execute simplified commands:

Reminder:
- To launch the command prompt, go to the start menu and execute "cmd".
- To paste the following command lines in dos command prompt, right click and select paste.
- To go to the repertory in which is installed OpenSSL, execute:
cd c:\
cd OpenSSL (or cd OpenSSL-Win32)
cd bin

The private key is generated with the following command. Define a file name that suits you:
C:\OpenSSL\bin\openssl.exe genrsa 2048 > site-file.key

then use this command to generate the CSR:
C:\OpenSSL\bin\openssl.exe req -new -key site-file.key > site-file.csr

or this one:
C:\OpenSSL\bin\openssl.exe req -new -key site-file.key -config "C:\OpenSSL\openssl.cnf" -out site-file.csr
On some platforms, the openssl.cnf file that OpenSSL reads by default to create the CSR is not the right one or does not exist. In that case download ours and store it in C:\OpenSSL\openssl.cnf:

For Symantec or Thawte server certificates: openssl-dem-server-cert-thvs.cnf
For TBS X509 or Comodo server certificates: openssl-dem-server-cert.cnf
You'll be asked by the system to fill-in fileds ; Fill them in and respect the instructions (more information on Obtain a server certificate)


Country Name (2 letter code) []: (FR for example)
State or Province Name (full name) [Some-State]: (the name of your state in full letters)
Locality Name (eg, city) []: (the name of your city)
Organization Name (eg, company) []: (the name of your organization)
Organizational Unit Name (eg, section) []: (let blank - advised - or provide a generic term such as "IT department")
Common Name (eg, YOUR name) []: (the name of the site to be secured)
Email Address []: (let blank)

Let the other fields blank, they are optional.
You'll get 2 files: site-file.key and site-file.csr. Keep the private key file safe (site-file.key) and copy/paste the content of the site-file.csr file in the order form.
Warning: Do not ever give us or any other third part the private key file. It would then be compromised and the security of your site would be as well.

(I found it on this site: http://www.tbs-certificates.co.uk/FAQ/e ... html#volet )

[teebe]

I made my trials, re-installing OpenVPN 2.1.3 not under Program Files, in the end the installator on my machine scratch'd the PATH variable so nothing was as before, once installed. Furhter, v2.1.3 scripts do not have care of Win7 x86/64, so this is why it must not be installed in the standard way. (In Win 64bit is installed under Progr..(x86)\OpenVPN but vars/openssl looks into missing Program Files\OpenVPN\bin folder).
All errors cleared and ca's created.
Who made the Win installer? Onion to him...