Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I attempted to generate some OpenVPN keys for a new employee the other day. Same procedure as normal. Nothing has changed in this area for months.

During the certificate generation I get the following error:

Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
entry 22: invalid expiry date

After some searching, there doesn't appear to be a clear answer. Some sites said something about a database file index.txt becoming damaged. Others said that its something to do with the default_days setting in openssl.cnf. Other sites suggested its an OpenSSL bug.

Anyone have any clues?


After more research I have discovered that there is a bug with OpenSSL where the expiration date for the last generated certificate goes beyond the year 2050, and thus the date in the index.txt has two extra digits added to it for some reason, thus making the index.txt appear corrupted. I'm not sure how to fix this.

share|improve this question
First of all. Is "entry 22" your last key ? Could the certificate be generated ? If it did, is it number 22 ? You can check the index.txt file, which has the certificate's generation number and its cn. –  Torian Oct 2 '10 at 1:43

1 Answer 1

This is a 'Year 2038 Problem' bug! It seems that OpenVPN certificates cannot be generated which expire after Jan. 19, 2038. I'm using Ubuntu 10.04 and OpenVPN 2.1.0.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.