Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've added an OpenVPN client using the OpenVPN's /etc/openvpn/easy-rsa/2.0/build-key-pass script. However, I entered a typo on the person's name field, so I'd like to regenerate it. However, when I re-ran the script, it seemed to run correctly until the end, when it terminated with the error:

failed to update database
TXT_DB error number 2

Googling shows this error is rarely encountered, but in one reported case, a suggested solution was to run openssl ca -revoke <username>.crt.

However, when I try this, I get:

Using configuration from /etc/pki/tls/openssl.cnf
Error opening CA private key /etc/pki/CA/private/cakey.pem
1403244616130376:error:02001002:system library:fopen:No such file or directory:bss_file.c:392:fopen('/etc/pki/CA/private/cakey.pem','r')
1403244616130376:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:394:
unable to load CA private key

So now I'm trying to simply remove my previous crt and start over. How do I do this? I tried manually deleting the *.crt, *.csr, and *.key files generated, but re-running build-key-pass gives me the same db error. What's the best way to resolve this?

share|improve this question
up vote 0 down vote accepted

Just put it on CRL list and create new cert.

share|improve this answer
Could you please elaborate? I'm new to OpenVPN. – Cerin Mar 21 '11 at 19:23
Check this… – Ency Mar 21 '11 at 19:25
Like I said, I already deleted the crt, csr, and key files, so running revoke-full fails, because it needs these files. – Cerin Mar 21 '11 at 19:34
Well, I missed that, can't you just go through easy-rsa process again? It should work ... – Ency Mar 21 '11 at 19:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.