Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've stablished a VPN using OpenVPN and it is all working.. almost.. My machines can see each other but on Handshake it all fails.

The error at first referred to a blocked port but ports are good. It fails even with no firewall working.

It then marked a certificate error.

So I validated my certs using:

openssl verify -purpose any client1.crt 


openssl verify -purpose any -CAfile ca.crt client1.crt

When I validate the signature on my certs on my Server side, It all works fine, I recieve a final "OK" ...

And when I validate on my client side, it fails always. Receiving at the end this error:

error 20 at 0 depth lookup:unable to get local issuer certificate

Why is this happening?

Why they don't match?

If is necesary a config file, or clarification ask for it and I'll post it. Thank you!

share|improve this question
You are copying the ca.crt file used to sign the client1.crt to the client machine, right? And the ca.crt file is properly readable, etc.? –  cjc Jan 16 '13 at 17:59
@cjc Yes, it is right all you're saying .. just.. with "properly readable" what do yo mean? –  AAlvz Jan 16 '13 at 18:09
When you see "unable to get local issuer certificate", that means the root CA certificate is not in the CAfile you specified. –  David Schwartz Jan 16 '13 at 18:35
@DavidSchwartz Isn't this line specifying which is the CAfile??: openssl verify -purpose any -CAfile /etc/openvpn/ca.crt /etc/openvpn/client1.crt –  AAlvz Jan 16 '13 at 19:05
Yes. So check if that file has the correct CA certificate. –  David Schwartz Jan 16 '13 at 19:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.