Ovpn Certificate Refresh / CA Expiry

Colin Ryan <[email protected]> Mon, 9 Feb 2026 12:45:18 -0500
Newsgroups gmane.network.openvpn.user
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--===============5189463088746669449==
Content-Type: multipart/alternative;
 boundary="------------sXBKsHTaccZSlv5RVT050Ar8"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------sXBKsHTaccZSlv5RVT050Ar8
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Folks,

Stock configurations with EasyRSA created cert chain. i.e ca.crt, 
server.crt and client.crt

CA and downward is soon expiring.

I'm created an entirely new chain. Then combined the ca.crt PEM outputs 
into a common file


i.e


----BEGIN CERTIFICATE----

----END CERTIFICATE----


----BEGIN CERTIFICATE----

----END CERTIFICATE----


My understanding was that so long as the first chain had not yet expired 
I could do this, then start upgrading my clients files with their new 
client.key/client.crt and old and new would work against this. Then when 
all clients were updated I could remove reference to the original CA on 
the server side.


The combined CA.crt file successfully validates both old and new 
server.crt files via

openssl verify -CAfile combined-ca.crt oldserver.crt and

openssl verify -CAfile combined-ca.crt newserver.crt

But whenever I try to start Openvpn I get the following:


Cannot load CA certificate file combined-ca.crt (entry 2 did not validate)
Cannot load CA certificate file combined-ca.crt (only 1 of 2 entries were valid X509 names)
Exiting due to fatal error


I even regen'ed them again so that the issuer and subject paths were 
different.

All the basic check pass. Both old and new certs have correct Basic 
Contraints of  CA:TRUE, the signature algo's are correct and the same. 
All openssl based checks work, it seems to be a validation challenge 
within OpenVPN.

I even tried doing c_rehash against the certs in their directory and 
tried use the "capath" directive instead of "ca". That seemed to let 
process start but client the failed validation.

Thoughts?

Sincerely

Colin

--------------sXBKsHTaccZSlv5RVT050Ar8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Folks,</p>
    <p>Stock configurations with EasyRSA created cert chain. i.e ca.crt,
      server.crt and client.crt</p>
    <p>CA and downward is soon expiring.</p>
    <p>I'm created an entirely new chain. Then combined the ca.crt PEM
      outputs into a common file</p>
    <p><br>
    </p>
    <p>i.e </p>
    <p><br>
    </p>
    <p>----BEGIN CERTIFICATE----</p>
    <p>----END CERTIFICATE----</p>
    <p><br>
    </p>
    <p>----BEGIN CERTIFICATE----</p>
    <p>----END CERTIFICATE----</p>
    <p><br>
    </p>
    <p>My understanding was that so long as the first chain had not yet
      expired I could do this, then start upgrading my clients files
      with their new client.key/client.crt and old and new would work
      against this. Then when all clients were updated I could remove
      reference to the original CA on the server side.</p>
    <p><br>
    </p>
    <p>The combined CA.crt file successfully validates both old and new
      server.crt files via</p>
    <p>openssl verify -CAfile combined-ca.crt oldserver.crt and</p>
    <p>openssl verify -CAfile combined-ca.crt newserver.crt</p>
    <p>But whenever I try to start Openvpn I get the following:</p>
    <p><br>
    </p>
    <pre>Cannot load CA certificate file combined-ca.crt (entry 2 did not validate)
Cannot load CA certificate file combined-ca.crt (only 1 of 2 entries were valid X509 names)
Exiting due to fatal error</pre>
    <p><br>
    </p>
    <p>I even regen'ed them again so that the issuer and subject paths
      were different.</p>
    <p>All the basic check pass. Both old and new certs have correct
      Basic Contraints of  CA:TRUE, the signature algo's are correct and
      the same. All openssl based checks work, it seems to be a
      validation challenge within OpenVPN.</p>
    <p>I even tried doing c_rehash against the certs in their directory
      and tried use the "capath" directive instead of "ca". That seemed
      to let process start but client the failed validation.</p>
    <p>Thoughts?</p>
    <p>Sincerely</p>
    <p>Colin</p>
    <p></p>
  </body>
</html>

--------------sXBKsHTaccZSlv5RVT050Ar8--


--===============5189463088746669449==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============5189463088746669449==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

--===============5189463088746669449==--