Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got a certificate from my network administrator and the passphrase for it. Put everything in the Tunnelblick configuration folder, but always get an error:

2010-11-20 13:22:10 Cannot load private key file vpn-pass.key: error:06065064:digital envelope routines:EVP_DecryptFinal:bad decrypt: error:0906A065:PEM routines:PEM_do_header:bad decrypt: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib

Everything was copy&paste and it works on a windows machine. How can I get this to work?

share|improve this question
up vote 0 down vote accepted

In config file, try commenting out:


and add:

share|improve this answer

It's possible that the private key is in the wrong format. What does the first line of the private key look like? It should read something like:


If it looks like anything else, you'll probably need to have your administrator give you the key in the appropriate format. Assuming that it's in the right format, you can verify that you're using the correct password like this:

openssl rsa -in vpn-pass.key -noout -text

This should prompt you for your password and then display lots of information about the key. The error you're seeing is frequently caused by using the wrong password.

As you may have noticed, OpenSSL has terrible error messages.

share|improve this answer
This is the first line: -----BEGIN RSA PRIVATE KEY----- As mentioned the same configuration and keyfiles work on another laptop with windows. But the error messages are really horrible indeed. – Patrick Nov 20 '10 at 14:03
See if the openssl command is able to handle the file correctly. Also, make sure the key file is where OpenVPN expects to find should generally be in the same folder as the OpenVPN configuration file. – larsks Nov 20 '10 at 14:44
140735079410940:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:466: 140735079410940:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:476: This it the output of the openssl command. Can't get any information out of the errors. – Patrick Nov 22 '10 at 11:09
This strongly suggests that for whatever reason the password you are using is not the correct password for this key file. If you're certain the files are identical to those on the Windows system, then I'm going to have to defer to someone with more OpenSSL experience. – larsks Nov 22 '10 at 14:56

You might want to ask your question on the Tunnelblick Discussion Group at

Post your complete log file from the Tunnelblick Details... window

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.