Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed OpenVPN and followed the steps to create a CA.crt in addition to other certificates. I've recreated the certificates numerous times in hopes of connecting but have been unsuccessful.

I thought at first it might be an issue with firewall, but I was able to successfully connect to the OpenVPN server using a username and password. I confirmed I was connected by checking the IP address using third party service.

If someone could possible explain to me what I may be doing wrong. I suspect my issue has to do with the certificate creation. I used this Openssl command to verify the certificate and got this message.

openssl verify -CAfile keys/ca.crt keys/vpn-client1.crt
keys/ukvpn-client1.crt: OK

Here's the output from the OpenVPN GUI connection log.

Mon Nov 19 00:34:56 2012 us=625000   netbios_node_type = 0
Mon Nov 19 00:34:56 2012 us=625000   disable_nbt = DISABLED
Mon Nov 19 00:34:56 2012 us=625000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Nov 19 00:34:56 2012 us=625000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Nov 19 00:34:56 2012 us=765000 LZO compression initialized
Mon Nov 19 00:34:56 2012 us=765000 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 19 00:34:56 2012 us=765000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Nov 19 00:34:56 2012 us=765000 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Nov 19 00:34:56 2012 us=765000 Local Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Nov 19 00:34:56 2012 us=765000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Nov 19 00:34:56 2012 us=765000 Local Options hash (VER=V4): 'd3a7571a'
Mon Nov 19 00:34:56 2012 us=765000 Expected Remote Options hash (VER=V4): '5b1533a2'
Mon Nov 19 00:34:56 2012 us=765000 UDPv4 link local: [undef]
Mon Nov 19 00:34:56 2012 us=765000 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Mon Nov 19 00:34:56 2012 us=906000 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=36291a5e 1136b11d
Mon Nov 19 00:35:02 2012 us=609000 VERIFY OK: depth=1, /C=CA/ST=ON/L=Toronto/O=OpenVPN/OU=changeme/CN=vpn.mydomain.com/name=changeme/emailAddress=uk@vpn.mydomain.com
Mon Nov 19 00:35:02 2012 us=609000 VERIFY OK: nsCertType=SERVER
Mon Nov 19 00:35:02 2012 us=609000 VERIFY OK: depth=0, /C=CA/ST=ON/L=Toronto/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=uk@vpn.mydomain.com
Mon Nov 19 00:35:56 2012 us=921000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Nov 19 00:35:56 2012 us=921000 TLS Error: TLS handshake failed
Mon Nov 19 00:35:56 2012 us=921000 TCP/UDP: Closing socket
Mon Nov 19 00:35:56 2012 us=921000 SIGUSR1[soft,tls-error] received, process restarting
Mon Nov 19 00:35:56 2012 us=921000 Restart pause, 2 second(s)
Mon Nov 19 00:35:58 2012 us=921000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Nov 19 00:35:58 2012 us=921000 Re-using SSL/TLS context
Mon Nov 19 00:35:58 2012 us=921000 LZO compression initialized
Mon Nov 19 00:35:58 2012 us=921000 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 19 00:35:58 2012 us=921000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Nov 19 00:35:58 2012 us=921000 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Nov 19 00:35:58 2012 us=921000 Local Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Nov 19 00:35:58 2012 us=921000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Nov 19 00:35:58 2012 us=921000 Local Options hash (VER=V4): 'd3a7571a'
Mon Nov 19 00:35:58 2012 us=921000 Expected Remote Options hash (VER=V4): '5b1533a2'
Mon Nov 19 00:35:58 2012 us=921000 UDPv4 link local: [undef]
Mon Nov 19 00:35:58 2012 us=921000 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Mon Nov 19 00:35:59 2012 us=62000 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=84dbe35d e4ca7815
Mon Nov 19 00:36:03 2012 us=937000 VERIFY OK: depth=1, /C=CA/ST=ON/L=Toronto/O=OpenVPN/OU=changeme/CN=vpn.mydomain.com/name=changeme/emailAddress=uk@vpn.mydomain.com
Mon Nov 19 00:36:03 2012 us=937000 VERIFY OK: nsCertType=SERVER
Mon Nov 19 00:36:03 2012 us=937000 VERIFY OK: depth=0, /C=CA/ST=ON/L=Toronto/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=uk@vpn.mydomain.com
share|improve this question
1  
That log is unreadable. Try using the formatting options to change it. –  gparent Nov 19 '12 at 6:21
    
I'm absolutely useless with the this site's editing tools, so thank you Shane Madden, for cleaning that up for me. –  Andre Nov 19 '12 at 6:35
    
You just got here, you will be up to speed with some Markdown very shortly I am sure. Click on the question mark near the top right of the editing/question/answer window, or click help when you are able to comment (rep 50, btw) to get some quick notes to help out. (Not any help with your question, but hopefully some guidance to the site.) –  vgoff Nov 19 '12 at 9:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.