[Solved] Certificate error in Openvpn (was previously working)

[cowst]

Hi,
I recently formatted jffs and enabled scripts, and since then my previously working openvpn connection now fails to connect with the following:

VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-N66U, emailAddress=me@myhost.mydomain

any known reason for this (I remember in the past there were some warning in FW updates meddling with jffs)?

 

[RMerlin]

Formatting jffs causes new key/certs to be generated.

Sent from my Nexus 5X using Tapatalk

 

[cowst]

So I remembered correctly.
But now, how do I make the openvpn server use the new ones and the client configuration match them as well?
Before it was all out of the box.

Thanks

 

[martinr]

So I remembered correctly.
But now, how do I make the openvpn server use the new ones and the client configuration match them as well?
Before it was all out of the box.

Thanks

Re-export fresh .ovpn config files to each client from the General setting tab on the Openvpn Server webui page? (Would the Openvpn server not automatically use them in that (jffs) location?)

 

[cowst]

Re-export fresh .ovpn config files to each client from the General setting tab on the Openvpn Server webui page? (Would the Openvpn server not automatically use them in that (jffs) location?)

I changed subnet, so everything should be generated anew.
Then I restarted the server (you never know), exported the client1.ovpn and sent to an old working client and a brand new phone.
Both have same cert issue.

Sent from my SM-G920F using Tapatalk

 

[martinr]

When I ran into something similar I bit the bullet and restored to factory default settings, manually reconfigured and then re-started the Openvpn server for the first time, as it were, which regenerates the keys and certs, and then re-exported the client .ovpn config files. However, I know you are more clued up than I, so you'll probably find an easier way.

 

[cowst]

That would be my very last weapon, I would regenerate certificates myself somehow (I'd have to figure the appropriate way).
However, I hope merlin has a simpler advice.

 

[RMerlin]

That would be my very last weapon, I would regenerate certificates myself somehow (I'd have to figure the appropriate way).
However, I hope merlin has a simpler advice.

Just make sure you export the updated ovpn config to your clients, so they will match the existing router certs.

 

[cowst]

Just make sure you export the updated ovpn config to your clients, so they will match the existing router certs.

That was the first thing I checked.
I'll search again the file by name in each device and delete it before exporting again.
No room for mistake.

So I understand that it should still work out of the box after the jffs format.

Sent from my SM-G920F using Tapatalk

 

[cowst]

I feel stupid.
wiping all client1.ovpn everywhere, changing a openvpn server setting, restarting, importing again in the new phone, it worked