bad X509 key usage in leaf certificate

[harri]

I've got a problem at connection time. AFAICS the certificate chain is verified correctly, but then openVPN fails with

Code: Select all

VERIFY FAIL -- bad X509 key usage in leaf certificate
Transport Error: PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
EVENT: CERT_VERIFY_FAIL PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed [ERR]
EVENT: DISCONNECTED

The X509v3 extensions of my certificate are

Code: Select all

X509v3 Basic Constraints: critical
    CA:FALSE
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment, Data Encipherment, Key Agreement
X509v3 Extended Key Usage: 
    TLS Web Client Authentication
Netscape Comment: 
    xca certificate

On Linux this works fine, so every helpful comment is highly appreciated.
The openVPN app is version 1.0.2.

[jamesyonan]

This error normally occurs when you are using the remote-cert-ku directive to force additional server certificate checks on the client, and those checks are failing.

James

[harri]

Problem solved.
Thanx very much
Harri

[jongyau]

Can you provide more information about how to solve the problem?
Many thanks!