Hallo,
Ich habe folgenden openVPN Server installiert:
Code
OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 29 2022
library versions: OpenSSL 1.0.2u 20 Dec 2019, LZO 2.08
Originally developed by James Yonan
Leider im Log beim Zugriff vom (Android) VPN Client der Fehler:
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 VERIFY OK: depth=1, CN=ChangeMe
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 VERIFY ERROR: depth=0, error=certificate has expired: CN=klaus
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 TLS_ERROR: BIO read tls_read_plaintext error
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 TLS Error: TLS object -> incoming plaintext read error
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 TLS Error: TLS handshake failed
Apr 23 13:51:16 raspberrypi ovpn-server[30285]: 46.74.229.208:44648 SIGUSR1[soft,tls-error] received, client-instance restarting
unter /etc/openvpn liegt das server zertifikat crl.pem, das sieht so aus:
root@raspberrypi:/etc/openvpn# sudo openssl crl -in crl.pem -text
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: ecdsa-with-SHA256
Issuer: /CN=ChangeMe
Last Update: Apr 23 11:54:54 2023 GMT
Next Update: Apr 20 11:54:54 2033 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:B1:50:F7:BF:BC:46:0D:8B:6E:87:0A:79:D0:76:65:4A:E5:49:C4:5F
DirName:/CN=ChangeMe
serial:DF:F7:CC:2A:3B:4B:0E:3C
und ich denke das ist das problem.
Nur wie kann ich das erneuern?
danke