I have a working (until now) ubuntu openvpn server.

I think that my server is using a wrong CA to sign client CRTs.


I use "source ./vars" followed by "./build-key john.doe" and it all works ok (by working ok I mean that I get john.doe's csr, crt and key).

But if I test the crt with: "openssl verify -CAfile ca.crt keys/john.doe.crt" I get the following:

keys/john.doe.crt: C = VE, ST = MI, L = Caracas, O =www www, CN = john.doe, emailAddress = me@myhost.mydomain error 20 at 0 depth lookup:unable to get local issuer certificate

Testing any working (and older) client crt, throws no error...

I tried this command too: "openssl x509 -in keys/jhon.doe.crt -noout -text | grep Issuer" and throws:

Issuer: C=VE, ST=MI, L=Caracas, O=www www, CN=fred.durst/name=Fred Durst/emailAddress=me@myhost.mydomain

Which is pretty weird, because Fred Durst is a client, not a CA...

When I try the same command with a working client crt, it throws:

Issuer: C=VE, ST=MI, L=Caracas, O=www www, OU=Section, CN=SGBVPN/name=SGBVPN

Which looks fine to me... Curiously, Fred Durst was the last created crt before all this issue came up.. All the older client crts created before fred.durst works just fine, The issue is just happening with new keys only...

Any clues? TIA

  • Can you update your question, and use iether the 'quote' block or source block to clean up your question so that command output is visually distinct from your question? – Zoredache Sep 17 '13 at 22:06
  • @Zoredache Done – hecstevez Sep 17 '13 at 22:36
  • What's the modification time on ca.crt? If you think it might have been accidentally overwritten, that'd be one basic question I'd ask. – MadHatter Sep 18 '13 at 6:09
  • @MadHatter The modification date was april of 2012, so I'm certain it wasn't overwritten. – hecstevez Sep 18 '13 at 13:35
  • OK. I'm rather with Falcon, then; sorry. – MadHatter Sep 18 '13 at 13:52

There isn't exactly a standard way of generating these certificates. Depending on the content of your script, it might be doing several things. However, there are two things I am going to point out.

Firstly, you haven't said the connectivity isn't working. I really hope that nobody is able to authenticate with these certificates; if they are, it means that any user could sign another arbitrary certificate request and grant access to your VPN. The way to prevent this is to issue certificates which are explicitly not CA certificates and only have the necessary key usage attributes set.

Anyway, typically you will be signing the certificates with the openssl ca command, which depends on parameters from an openssl.conf file (typically in /etc/openssl.conf or specified on the command line). Check that the options in this are correct. Find the CA certificate and key it is using, and ensure they are correct (again, this is either in the openssl configuration file or on the command line).

If you aren't using openssl, the same general solution applies - find the CA certificate and make sure it hasn't been replaced by accident.

If you have somehow managed to overwrite the key (or someone else did), you will have to find a backed up copy or rebuild your PKI.

Without the contents of your script there is not much more I can tell you.

  • Well, in fact, I cannot make a connection with this crt. I was signing the csr with the pkitool included with openvpn. I've signed the csr using openssl directly and it worked. Thanks to you I've found that there is something weird with the pkitool script. I have to check it... TY – hecstevez Sep 18 '13 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.