Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've added an OpenVPN client using the OpenVPN's /etc/openvpn/easy-rsa/2.0/build-key-pass script. However, I entered a typo on the person's name field, so I'd like to regenerate it. However, when I re-ran the script, it seemed to run correctly until the end, when it terminated with the error:

failed to update database
TXT_DB error number 2

Googling shows this error is rarely encountered, but in one reported case, a suggested solution was to run openssl ca -revoke <username>.crt.

However, when I try this, I get:

Using configuration from /etc/pki/tls/openssl.cnf
Error opening CA private key /etc/pki/CA/private/cakey.pem
1403244616130376:error:02001002:system library:fopen:No such file or directory:bss_file.c:392:fopen('/etc/pki/CA/private/cakey.pem','r')
1403244616130376:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:394:
unable to load CA private key

So now I'm trying to simply remove my previous crt and start over. How do I do this? I tried manually deleting the *.crt, *.csr, and *.key files generated, but re-running build-key-pass gives me the same db error. What's the best way to resolve this?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Just put it on CRL list and create new cert.

share|improve this answer
    
Could you please elaborate? I'm new to OpenVPN. –  Cerin Mar 21 '11 at 19:23
    
Check this openvpn.net/index.php/open-source/documentation/… –  Ency Mar 21 '11 at 19:25
    
Like I said, I already deleted the crt, csr, and key files, so running revoke-full fails, because it needs these files. –  Cerin Mar 21 '11 at 19:34
    
Well, I missed that, can't you just go through easy-rsa process again? It should work ... –  Ency Mar 21 '11 at 19:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.