> On Apr 17, 2015, at 11:31, Jan Just Keijser <[email protected]> wrote:
> this is indeed an entirely different error; I'd suggest to generate your
> certificates using the easy-rsa scripts; most likely what you're missing is
> the X509v3 purpose flag - you can verify this using
> openssl x509 -text -noout -in client.crt
Yup. I had been working this out myself. The openssl.cnf I’m using, which
as I noted I’ve had around for a while, has
x509_extensions = server_cert
… and I didn’t override that on the command line. Making sure I have a
reasonable section in my config, and selecting it with -extensions, provides me
with a certificate that’s more reasonable:
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Client
Netscape Comment:
OpenSSL Generated Client Certificate
X509v3 Subject Key Identifier:
E8:6D:89:9E:E4:C1:68:66:39:9E:51:36:79:37:A9:AD:BF:3B:60:00
X509v3 Key Usage:
Digital Signature
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Authority Key Identifier:
keyid:96:BB:19:97:E0:C6:D8:DD:7C:97:75:26:66:FC:EF:CD:E0:24:5D:DB
And, after fixing that certificate error, I’m able to connect.
Thank you all for your help! I’m still not sure what my previous problem
was, but after updating numerous things on the server side, and then fixing a
user error, I’m operational. Hopefully, all else will be clear to me from here
on out. :-)
- Chris
------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
