Re: Ovpn Certificate Refresh / CA Expiry
Colin Ryan <[email protected]> Thu, 12 Feb 2026 10:43:56 -0500
| Newsgroups | gmane.network.openvpn.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============5247732599629245305== Content-Type: multipart/alternative; boundary="------------3aYkiCLek0bxMlmBChm9LfsN" Content-Language: en-US This is a multi-part message in MIME format. --------------3aYkiCLek0bxMlmBChm9LfsN Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Nevermind. Not sure what it was exactly but redid all this and seems to work as expected. C On 2026-02-09 12:45 PM, Colin Ryan wrote: > > Folks, > > Stock configurations with EasyRSA created cert chain. i.e ca.crt, > server.crt and client.crt > > CA and downward is soon expiring. > > I'm created an entirely new chain. Then combined the ca.crt PEM > outputs into a common file > > > i.e > > > ----BEGIN CERTIFICATE---- > > ----END CERTIFICATE---- > > > ----BEGIN CERTIFICATE---- > > ----END CERTIFICATE---- > > > My understanding was that so long as the first chain had not yet > expired I could do this, then start upgrading my clients files with > their new client.key/client.crt and old and new would work against > this. Then when all clients were updated I could remove reference to > the original CA on the server side. > > > The combined CA.crt file successfully validates both old and new > server.crt files via > > openssl verify -CAfile combined-ca.crt oldserver.crt and > > openssl verify -CAfile combined-ca.crt newserver.crt > > But whenever I try to start Openvpn I get the following: > > > Cannot load CA certificate file combined-ca.crt (entry 2 did not validate) > Cannot load CA certificate file combined-ca.crt (only 1 of 2 entries were valid X509 names) > Exiting due to fatal error > > > I even regen'ed them again so that the issuer and subject paths were > different. > > All the basic check pass. Both old and new certs have correct Basic > Contraints of CA:TRUE, the signature algo's are correct and the same. > All openssl based checks work, it seems to be a validation challenge > within OpenVPN. > > I even tried doing c_rehash against the certs in their directory and > tried use the "capath" directive instead of "ca". That seemed to let > process start but client the failed validation. > > Thoughts? > > Sincerely > > Colin > > > > _______________________________________________ > Openvpn-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/openvpn-users --------------3aYkiCLek0bxMlmBChm9LfsN Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p>Nevermind. Not sure what it was exactly but redid all this and seems to work as expected.</p> <p>C</p> <div class="moz-cite-prefix">On 2026-02-09 12:45 PM, Colin Ryan wrote:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <p>Folks,</p> <p>Stock configurations with EasyRSA created cert chain. i.e ca.crt, server.crt and client.crt</p> <p>CA and downward is soon expiring.</p> <p>I'm created an entirely new chain. Then combined the ca.crt PEM outputs into a common file</p> <p><br> </p> <p>i.e </p> <p><br> </p> <p>----BEGIN CERTIFICATE----</p> <p>----END CERTIFICATE----</p> <p><br> </p> <p>----BEGIN CERTIFICATE----</p> <p>----END CERTIFICATE----</p> <p><br> </p> <p>My understanding was that so long as the first chain had not yet expired I could do this, then start upgrading my clients files with their new client.key/client.crt and old and new would work against this. Then when all clients were updated I could remove reference to the original CA on the server side.</p> <p><br> </p> <p>The combined CA.crt file successfully validates both old and new server.crt files via</p> <p>openssl verify -CAfile combined-ca.crt oldserver.crt and</p> <p>openssl verify -CAfile combined-ca.crt newserver.crt</p> <p>But whenever I try to start Openvpn I get the following:</p> <p><br> </p> <pre>Cannot load CA certificate file combined-ca.crt (entry 2 did not validate) Cannot load CA certificate file combined-ca.crt (only 1 of 2 entries were valid X509 names) Exiting due to fatal error</pre> <p><br> </p> <p>I even regen'ed them again so that the issuer and subject paths were different.</p> <p>All the basic check pass. Both old and new certs have correct Basic Contraints of CA:TRUE, the signature algo's are correct and the same. All openssl based checks work, it seems to be a validation challenge within OpenVPN.</p> <p>I even tried doing c_rehash against the certs in their directory and tried use the "capath" directive instead of "ca". That seemed to let process start but client the failed validation.</p> <p>Thoughts?</p> <p>Sincerely</p> <p>Colin</p> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Openvpn-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/openvpn-users">https://lists.sourceforge.net/lists/listinfo/openvpn-users</a> </pre> </blockquote> </body> </html> --------------3aYkiCLek0bxMlmBChm9LfsN-- --===============5247732599629245305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5247732599629245305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users --===============5247732599629245305==--