I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months.
During the certificate generation I get the following error:
Using configuration from /etc/openvpn/easy-rsa/openssl.cnf entry 22: invalid expiry date
After some searching, there doesn't appear to be a clear answer. Some sites said something about a database file index.txt becoming damaged. Others said that its something to do with the
default_days setting in
openssl.cnf. Other sites suggested its an OpenSSL bug.
Anyone have any clues?
After more research I have discovered that there is a bug with OpenSSL where the expiration date for the last generated certificate goes beyond the year 2050, and thus the date in the index.txt has two extra digits added to it for some reason, thus making the index.txt appear corrupted. I'm not sure how to fix this.