I have installed OpenVPN server on CentOS. I have two clients - first under CentOS (all works), and trying connect Windows client now.
I generated client's certificates with build-key
utility.
If I check it on server's side - all seems to be OK:
# openssl verify -CAfile /etc/openvpn/clients/setevoy/ca.crt /etc/openvpn/clients/setevoy/setevoy.crt
/etc/openvpn/clients/setevoy/setevoy.crt: OK
But - when I check same certificates under Windows - got error:
$ openssl verify -CAfile ca.crt setevoy.crt
setevoy.crt: /C=UA/ST=CA/L=Kiev/O=Fort-Funston/OU=MyOrganizationalUnit/CN=venti.setevoy.org.ua/name=openvpn_root/[email protected]
error 7 at 1 depth lookup:certificate signature failure
Files seems to be identical on server (from where I copied them) and on Windows client (where they are placed in c/Program Files (x86)/OpenVPN/config
:
# md5sum /etc/openvpn/clients/setevoy/ca.crt
53984cf44daffb708cdb937fa3d30438 /etc/openvpn/clients/setevoy/ca.crt
$ md5sum ca.crt
53984cf44daffb708cdb937fa3d30438 *ca.crt
# md5sum /etc/openvpn/clients/setevoy/setevoy.crt
c818d312e58db514a9a2afae4c687241 /etc/openvpn/clients/setevoy/setevoy.crt
$ md5sum setevoy.crt
c818d312e58db514a9a2afae4c687241 *setevoy.crt
I assume, something wrong with Windows OpenSSL mechanism... Or something similar issue:
$ head setevoy.crt | grep Signature
Signature Algorithm: sha256WithRSAEncryption
Then, when I try start OpenVNP GUI - got error:
Wed Dec 17 11:44:25 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Wed Dec 17 11:44:25 2014 TLS Error: TLS object -> incoming plaintext read error Wed Dec 17 11:44:25 2014 TLS Error: TLS handshake failed
UPD
On server:
# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
and on Windows client:
$ openssl.exe version
OpenSSL 0.9.7l 28 Sep 2006
UPD 2
I upgraded OpenSSL for OpenVPN GUI, now it's 1.0.1, and verify
works:
$ ../bin/openssl.exe version
OpenSSL 1.0.1j 15 Oct 2014
$ ../bin/openssl.exe verify -CAfile ca.crt setevoy.crt
setevoy.crt: OK
But - I still can't connect, with same error in log.
I also installed new CentOS server, just for testing, and OpenVPN client there - all works. Problem with Windows client only.