Why don't my certificates match?

Question

I'm configuring a VPN with OpenVPN without interfaz, the problem is when I try to connect, it says:

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

But I know that is not the problem cause I've tried it even with the firewalls disabled... so, trying to figure it out, I ran:

openssl verify -purpose any -CAfile ca.crt client1.crt

In the server and also in the client, the weird thing is in the server everything's fine, but in the client it says:

error 20 at 0 depth lookup:unable to get local issuer certificate

I've tried with many certificates, and copying them in different ways... I am sure the crt's are the same, and also I've tried it with the complete route and so on...

Could somebody give me a hand with this??

The server is Ubuntu 12.04 and the client is CentOS 6

If any other information is required, please tell me!

Answer 1

What exactly are you trying to achieve? Should the server identify the client by its certificate (client authentication) or the other way around (or both)?

It sounds like the ca.crt is not the same on both machines. Or that intermediate certificates are missing (i.e. your CA certificate was signed by another CA that Ubuntu knows/trusts but CentOS does not).

Are you sure the certificate (client1.crt) is signed with the CA cert (ca.crt) and both files (i.e. client1.crt and ca.crt) are the same on both machines? When you execute

openssl x509 -in client1.crt -noout -text |grep Issuer

you should get the same output (on both machines) as when you do

openssl x509 -in ca.crt -noout -text |grep Subject |head -n1

(check the "CN" attribute).

You might also try

openssl verify -CAfile ca.crt client1.crt

on CentOS (skip the -pupose any part).

Did you check the logs? No hints in there?

If the problem persists and you can/want to share the information, the full output of

openssl x509 -in ca.crt -noout -text
openssl x509 -in client1.crt -noout -text

might be useful.

---

EDIT: Did you check this page on the OpenVPN internet site? TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)