I have a working (until now) ubuntu openvpn server.
I think that my server is using a wrong CA to sign client CRTs.
I use "source ./vars" followed by "./build-key john.doe" and it all works ok (by working ok I mean that I get john.doe's csr, crt and key).
But if I test the crt with: "openssl verify -CAfile ca.crt keys/john.doe.crt" I get the following:
keys/john.doe.crt: C = VE, ST = MI, L = Caracas, O =www www, CN = john.doe, emailAddress = firstname.lastname@example.org error 20 at 0 depth lookup:unable to get local issuer certificate
Testing any working (and older) client crt, throws no error...
I tried this command too: "openssl x509 -in keys/jhon.doe.crt -noout -text | grep Issuer" and throws:
Issuer: C=VE, ST=MI, L=Caracas, O=www www, CN=fred.durst/name=Fred Durst/emailAddressemail@example.com
Which is pretty weird, because Fred Durst is a client, not a CA...
When I try the same command with a working client crt, it throws:
Issuer: C=VE, ST=MI, L=Caracas, O=www www, OU=Section, CN=SGBVPN/name=SGBVPN
Which looks fine to me... Curiously, Fred Durst was the last created crt before all this issue came up.. All the older client crts created before fred.durst works just fine, The issue is just happening with new keys only...
Any clues? TIA