Use signed certificate
Posted: Mon Oct 03, 2011 9:56 am
Hi
I am actually trying to used our signed certificate fo our server. Everyone should be able to log in without any certificate. I've made a test with a self-signed and it works perfectly. I just put the ca.cert and the .ovpn in the client configuration folder and it's good. I'd like to make the same, but with our certificate now.
Here is my configuration:
Here is a log from the client:
I probably missed something here, but can't see what 
Any advice?
I am actually trying to used our signed certificate fo our server. Everyone should be able to log in without any certificate. I've made a test with a self-signed and it works perfectly. I just put the ca.cert and the .ovpn in the client configuration folder and it's good. I'd like to make the same, but with our certificate now.
Here is my configuration:
Code: Select all
port 1194
proto udp
dev tun
ca GeoTrust_Global_CA.cer
cert lafourchette.com.pem
key lafourchette.com.key
dh dh2048.pem
server ***** 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route **** 255.255.254.0"
push "route **** 255.255.255.240"
push "route **** 255.255.255.240"
push "dhcp-option DOMAIN ****.lan"
push "dhcp-option DNS ****"
push "dhcp-option DNS ****"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf
client-cert-not-required
Code: Select all
Mon Oct 03 11:23:27 2011 Restart pause, 2 second(s)
Mon Oct 03 11:23:29 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Oct 03 11:23:29 2011 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Mon Oct 03 11:23:29 2011 Re-using SSL/TLS context
Mon Oct 03 11:23:29 2011 LZO compression initialized
Mon Oct 03 11:23:29 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Oct 03 11:23:29 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Oct 03 11:23:29 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Oct 03 11:23:29 2011 Local Options hash (VER=V4): '41690919'
Mon Oct 03 11:23:29 2011 Expected Remote Options hash (VER=V4): '530fdded'
Mon Oct 03 11:23:29 2011 UDPv4 link local: [undef]
Mon Oct 03 11:23:29 2011 UDPv4 link remote: ****:1194
Mon Oct 03 11:23:29 2011 TLS: Initial packet from ****:1194, sid=13fe57af 03535ce2
Mon Oct 03 11:23:30 2011 VERIFY OK: depth=2, /C=US/O=GeoTrust_Inc./CN=GeoTrust_Global_CA
Mon Oct 03 11:23:30 2011 VERIFY OK: depth=1, /C=US/O=GeoTrust__Inc./CN=RapidSSL_CA
Mon Oct 03 11:23:30 2011 VERIFY nsCertType ERROR: /serialNumber=CakKRQGp02EewpGOLxx-r1QLXGaGl60Q/C=FR/O=_.lafourchette.com/OU=GT72845239/OU=See_www.rapidssl.com/resources/cps__c_11/OU=Domain_Control_Validated_-_RapidSSL_R_/CN=_.lafourchette.com, require nsCertType=SERVER
Mon Oct 03 11:23:30 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mon Oct 03 11:23:30 2011 TLS Error: TLS object -> incoming plaintext read error
Mon Oct 03 11:23:30 2011 TLS Error: TLS handshake failed
Mon Oct 03 11:23:30 2011 TCP/UDP: Closing socket
Mon Oct 03 11:23:30 2011 SIGUSR1[soft,tls-error] received, process restarting
Mon Oct 03 11:23:30 2011 Restart pause, 2 second(s)Any advice?