2

I have a working (until now) ubuntu openvpn server.

I think that my server is using a wrong CA to sign client CRTs.

E.g:

I use "source ./vars" followed by "./build-key john.doe" and it all works ok (by working ok I mean that I get john.doe's csr, crt and key).

But if I test the crt with: "openssl verify -CAfile ca.crt keys/john.doe.crt" I get the following:

keys/john.doe.crt: C = VE, ST = MI, L = Caracas, O =www www, CN = john.doe, emailAddress = [email protected] error 20 at 0 depth lookup:unable to get local issuer certificate

Testing any working (and older) client crt, throws no error...

I tried this command too: "openssl x509 -in keys/jhon.doe.crt -noout -text | grep Issuer" and throws:

Issuer: C=VE, ST=MI, L=Caracas, O=www www, CN=fred.durst/name=Fred Durst/[email protected]

Which is pretty weird, because Fred Durst is a client, not a CA...

When I try the same command with a working client crt, it throws:

Issuer: C=VE, ST=MI, L=Caracas, O=www www, OU=Section, CN=SGBVPN/name=SGBVPN

Which looks fine to me... Curiously, Fred Durst was the last created crt before all this issue came up.. All the older client crts created before fred.durst works just fine, The issue is just happening with new keys only...

Any clues? TIA

Improve this question
5
  • Can you update your question, and use iether the 'quote' block or source block to clean up your question so that command output is visually distinct from your question?
    – Zoredache
    Sep 17, 2013 at 22:06
  • @Zoredache Done
    – hecstevez
    Sep 17, 2013 at 22:36
  • What's the modification time on ca.crt? If you think it might have been accidentally overwritten, that'd be one basic question I'd ask.
    – MadHatter
    Sep 18, 2013 at 6:09
  • @MadHatter The modification date was april of 2012, so I'm certain it wasn't overwritten.
    – hecstevez
    Sep 18, 2013 at 13:35
  • OK. I'm rather with Falcon, then; sorry.
    – MadHatter
    Sep 18, 2013 at 13:52

1 Answer 1

Reset to default
2

There isn't exactly a standard way of generating these certificates. Depending on the content of your script, it might be doing several things. However, there are two things I am going to point out.

Firstly, you haven't said the connectivity isn't working. I really hope that nobody is able to authenticate with these certificates; if they are, it means that any user could sign another arbitrary certificate request and grant access to your VPN. The way to prevent this is to issue certificates which are explicitly not CA certificates and only have the necessary key usage attributes set.

Anyway, typically you will be signing the certificates with the openssl ca command, which depends on parameters from an openssl.conf file (typically in /etc/openssl.conf or specified on the command line). Check that the options in this are correct. Find the CA certificate and key it is using, and ensure they are correct (again, this is either in the openssl configuration file or on the command line).

If you aren't using openssl, the same general solution applies - find the CA certificate and make sure it hasn't been replaced by accident.

If you have somehow managed to overwrite the key (or someone else did), you will have to find a backed up copy or rebuild your PKI.

Without the contents of your script there is not much more I can tell you.

Improve this answer
1
  • Well, in fact, I cannot make a connection with this crt. I was signing the csr with the pkitool included with openvpn. I've signed the csr using openssl directly and it worked. Thanks to you I've found that there is something weird with the pkitool script. I have to check it... TY
    – hecstevez
    Sep 18, 2013 at 14:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .