OpenVPN Support Forum

Posted: **Mon Mar 06, 2023 10:28 pm**

Did someone remove my post on this topic? I could have sworn I asked this a couple weeks back and I thought I had it solved but now I'm on another server and having the same problem. I originally thought it was due to some limited administrator CMD prompt but I'm logged in as admin and command prompt says administrator (only)

OpenVPN 2.6.0 on windows.

Key error; easyrsa build-server-full server nopass

No it's not the wrong password, I'm pasting the same one I just used for the CA creation.

Code: Select all

Using configuration from C:/Program Files/OpenVPN/easy-rsa/pki/56756c1e/temp.6d15ace7
Enter pass phrase for C:/Program Files/OpenVPN/easy-rsa/pki/private/ca.key:
Could not read CA private key from C:/Program Files/OpenVPN/easy-rsa/pki/private/ca.key
0C1A0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:crypto\store\store_result.c:151:
0C1A0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers\implementations\ciphers\ciphercommon_block.c:124:
0C1A0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto\pkcs12\p12_decr.c:86:maybe wrong password

Easy-RSA error:

Signing failed (openssl output above may have more detail)


EasyRSA Version Information
Version:     3.1.2
Generated:   Fri Jan 13 15:49:33 CST 2023
SSL Lib:     OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
Git Commit:  354c20d82bdc5db364e197aa1290e84b46abe487
Source Repo: https://github.com/OpenVPN/easy-rsa
Host: 3.1.2 | win | @(#)MIRBSD KSH R39-w32-beta14 $Date: 2013/06/28 21:28:57 $ |

The entire session if you are interested;

Code: Select all

Microsoft Windows [Version 10.0.17763.4010]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd C:\Program Files\OpenVPN\easy-rsa

C:\Program Files\OpenVPN\easy-rsa>EasyRSA-Start

Welcome to the EasyRSA 3 Shell for Windows.
Easy-RSA 3 is available under a GNU GPLv2 license.

Invoke './easyrsa' to call the program. Without commands, help is displayed.

EasyRSA Shell
# easyrsa init-pki

WARNING!!!

You are about to remove the EASYRSA_PKI at:
* C:/Program Files/OpenVPN/easy-rsa/pki

and initialize a fresh PKI here.

Type the word 'yes' to continue, or any other input to abort.
  Confirm removal: yes


* SECOND WARNING!!!

* This will remove everything in your current PKI directory.
  To keep your current settings use 'init-pki soft' instead.
  Using 'init-pki soft' is recommended.

Type the word 'yes' to continue, or any other input to abort.
  Remove current 'vars' file? yes


Notice
------
'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:
* C:/Program Files/OpenVPN/easy-rsa/pki

* Using Easy-RSA configuration: C:/Program Files/OpenVPN/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>

* Using x509-types directory: C:/Program Files/OpenVPN/easy-rsa/x509-types


EasyRSA Shell
# easyrsa build-ca

* Using SSL: openssl OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)

* Using Easy-RSA configuration: C:/Program Files/OpenVPN/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>


Enter New CA Key Passphrase:

Confirm New CA Key Passphrase:
Using configuration from C:/Program Files/OpenVPN/easy-rsa/pki/68387971/temp.0c3ccfe0
..+.....+......+............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+......+.+............+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.....+.+......+...+..+.+.........+...........+.......+.......................+....+...+...+..+.+..+.........+.......+...+...+...............+.......+...+.........+.....+...+...+..........+.........+....................+.+......+...+..+.+.....+.............+..............+..........+..+..................+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:server23

Notice
------
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
C:/Program Files/OpenVPN/easy-rsa/pki/ca.crt


EasyRSA Shell
# easyrsa build-server-full server nopass

* Using SSL: openssl OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)

* Using Easy-RSA configuration: C:/Program Files/OpenVPN/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>
......+.....+...............+.+..+...+....+..+.+.........+.........+..+...+.+...+...+.....+...+.+...+..+.+.....+.........+...................+......+...+...+...+..+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+.+..............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.......+........+....+...+......+.....+......+..........+.....+......+.......+...+..............+....+......+.....+...+.......+......+..+................+.....+....+..+.+...+.............+..+.......+......+......+...+........+...+.+........+.+..+.......+..+..........+.........+......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----

Notice
------
Keypair and certificate request completed. Your files are:
req: C:/Program Files/OpenVPN/easy-rsa/pki/reqs/server.req
key: C:/Program Files/OpenVPN/easy-rsa/pki/private/server.key

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 7300 days:

subject=
    commonName                = server


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes

Using configuration from C:/Program Files/OpenVPN/easy-rsa/pki/56756c1e/temp.6d15ace7
Enter pass phrase for C:/Program Files/OpenVPN/easy-rsa/pki/private/ca.key:
Could not read CA private key from C:/Program Files/OpenVPN/easy-rsa/pki/private/ca.key
0C1A0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:crypto\store\store_result.c:151:
0C1A0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers\implementations\ciphers\ciphercommon_block.c:124:
0C1A0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto\pkcs12\p12_decr.c:86:maybe wrong password

Easy-RSA error:

Signing failed (openssl output above may have more detail)


EasyRSA Version Information
Version:     3.1.2
Generated:   Fri Jan 13 15:49:33 CST 2023
SSL Lib:     OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
Git Commit:  354c20d82bdc5db364e197aa1290e84b46abe487
Source Repo: https://github.com/OpenVPN/easy-rsa
Host: 3.1.2 | win | @(#)MIRBSD KSH R39-w32-beta14 $Date: 2013/06/28 21:28:57 $ |

EasyRSA Shell
#

Posted: **Mon Mar 06, 2023 10:53 pm**

Down graded to OpenVPN-2.5.9-I601-amd64, completely cleaned out my OpenVPN folder and started over. On a hunch I tried a couple different passwords in case I had a special symbol but even the simplest didn't make a difference in this issue.

And this is my complete vars;

Code: Select all

# see vars.example for settings usage
# This file belongs in; C:\Program Files\OpenVPN\easy-rsa

# Organization info, remember to edit the OU for server name
set_var EASYRSA_REQ_COUNTRY	"US"
set_var EASYRSA_REQ_PROVINCE	"SC"
set_var EASYRSA_REQ_CITY	"WestColumbia"
set_var EASYRSA_REQ_ORG	"Harris"
set_var EASYRSA_REQ_EMAIL	"it@harrisisi.com"
set_var EASYRSA_REQ_OU		"server#5"

# In how many days should the root CA key expire; 20 years
set_var EASYRSA_CA_EXPIRE	7300

# In how many days should certificates expire; 20 years
set_var EASYRSA_CERT_EXPIRE	7300

# How many days before its expiration date a certificate is allowed to be renewed; whenever
set_var EASYRSA_CERT_RENEW	7300

# 3.0.8 path bug workaround; https://github.com/OpenVPN/easy-rsa/issues/412
# you must create C:\Temp
# set_var EASYRSA_TEMP_DIR "C:/Temp"  #Hard file path error in OpenVPN 2.6.0, likely hasn't been needed for a while.

Posted: **Mon Mar 06, 2023 11:05 pm**

As you can see from the screenshot I absolutely am administrator on cmd prompt, this time. Every folder I'm looking at in openvpn easyrsa is full control for administrators. I'm confused. Server in question isn't even one of our newer images, win server 2019 ver 1809.

I installed openvpn 2.6.0 on my win 10 laptop and redid these commands and it works fine. So it is a permission issue but I have no idea where.

Posted: **Tue Mar 07, 2023 7:52 am**

Hi,

Could you please open an issue with easyrsa here: https://github.com/OpenVPN/easy-rsa/issues

Thx.
.

Posted: **Tue Mar 07, 2023 11:18 am**

https://github.com/OpenVPN/easy-rsa/issues/907

Posted: **Tue Mar 07, 2023 2:36 pm**

Hi,

Thanks.

maxburn wrote: ↑
Mon Mar 06, 2023 10:28 pm
Did someone remove my post on this topic?

Nope, no posts by you were deleted.
.

OpenVPN Support Forum

Could not read CA private key

Could not read CA private key

Re: Could not read CA private key

Re: Could not read CA private key

Re: Could not read CA private key

Re: Could not read CA private key

Re: Could not read CA private key