sudden peer certificate verification faillure

[kaneelschep]

Hi all.


I have been using openvpn for quite some time now without problems. Since last Thursday though, i get this error on all clients.
Peer certificate verification failure.
Nothing changed on server. Maybe client got updated?
Was there some change in certification rules or so? Can it be expired?
Anyone have an idea?

Thanks!

[franco]

> Can it be expired?

That would be my guess in lack of more information.


Cheers,
Franco

[kaneelschep]

I am sorry I dont have more info at the moment. I am on holiday. Thats the whole reason I was using the vpn ;)

And does anyone happen to know the standard expiration date? I thought it was 10 years?

[cookiemonster]

It's whatever was set when created.
If I rememeber correctly 10 years is for CA, not for server/client certs.

[CJ]

Expiration date depends on how it was created.  Also, there has been a push from various places to reduce the length of time certs are valid for but I'm not sure if that applies to VPNs.

[cookiemonster]

Not so much for CAs though, that I know of. This push indeed has been happening but is more for clients of webwservers.

[kaneelschep]

So I got home.
SSLVPN Server Certificate has indeed epired.
It was only valid for a year. User certificate is also almost expired.

I set it up myself, I guess a year ago, using a guide.
I am still learning about what I actually did and how it affects everything. I never did this before.

As I read, there is no simple renewal option. I just have to remake the certificate. And the user.
Is that right?

[cookiemonster]

technically speaking there is no option to renew a certificate, that is to extend the validity only. Not with openssl that I know of.
That said if you kept your original csr from last time you created it, you can reuse that csr to generate the new cert and then all its attributes are kept.
You don't need to recreate a user.

[kaneelschep]

Ah yes, I meant the user certificate. as it also expired. I use otp.

I made new certificates.. Not noticing the authority was also expired. ;)
So I did everything twice. I guess I wont forget anymore now.

My VPN works like before again.
Thanks!

[cookiemonster]

Nice