LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-19-2006, 03:13 AM   #1
Sleen
Member
 
Registered: Sep 2005
Location: Kampala,Uganda
Distribution: RHEL,FC,SUSE,UBUNTU
Posts: 41

Rep: Reputation: 15
openvpn client certificate is 0 bytes


Hi all,
I am configuring openvpn-2.0.8.I generated the ca,key and cert for both the server and the client.The client.crt for all clients is 0 bytes.Contains nothing.
My worry is,is this how it is suppose to be?because when i start the openvpn client,the config file is unable to open the certificate.
Some help please!
 
Old 10-19-2006, 04:48 PM   #2
andrewdodsworth
Member
 
Registered: Oct 2003
Location: United Kingdom
Distribution: SuSE 10.0 - 11.4
Posts: 347

Rep: Reputation: 30
Definitely not - my client crts are about 3.5Kb. Size probably depends on the encryption method. Sounds as though your keygen didn't work.
 
Old 10-20-2006, 01:28 AM   #3
Sleen
Member
 
Registered: Sep 2005
Location: Kampala,Uganda
Distribution: RHEL,FC,SUSE,UBUNTU
Posts: 41

Original Poster
Rep: Reputation: 15
What do you suggest i do?
 
Old 10-22-2006, 05:22 AM   #4
andrewdodsworth
Member
 
Registered: Oct 2003
Location: United Kingdom
Distribution: SuSE 10.0 - 11.4
Posts: 347

Rep: Reputation: 30
The OpenVPN documentation on their website is very good indeed so if you follow their steps exactly to generate keys it should work. The steps involve building your own CA, the server keys and the client keys. I'd follow their procedure exactly again which will delete existing keys and create new ones under the easy-rsa/keys directory. One possibility is that when you create the keys you MUST enter a unique common name. I use server for the server key and client1, client2 etcetera for the client keys. If you don't enter a common name it will give an error message and not generate the key. If it all works as planned you should get confirmation messages that the keys are genereated.

I generate all keys on the server as root and then securely copy the client keys to the correct clients.
 
Old 10-22-2006, 08:56 AM   #5
Sleen
Member
 
Registered: Sep 2005
Location: Kampala,Uganda
Distribution: RHEL,FC,SUSE,UBUNTU
Posts: 41

Original Poster
Rep: Reputation: 15
Thanks Andrew.
Actually,I had generated the keys again.I also use unique common names as advised by the openvpn documents.But still,i get client certificates that are 0 bytes large.I wonder what the prob is!
 
Old 10-23-2006, 04:48 AM   #6
andrewdodsworth
Member
 
Registered: Oct 2003
Location: United Kingdom
Distribution: SuSE 10.0 - 11.4
Posts: 347

Rep: Reputation: 30
Haven't got access to my linux server at the moment so working from memory.

Have you made sure that all the required parameters in the vars script have something in them? If the vars script has been run, did the CA and server key generate okay? Does it go through the client build script prompts okay and then asks for "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]" ? If so then it should generate the cert. If it does this but the cert is still 0 bytes then the only thing I can think of is file permissions.

Unfortunately apart from not completing all the necessary fields in the vars script and forgetting to put a common name in I've never had any issues with generating keys - I do them all on the server in the easy-rsa directory.

Have another go from scratch, record the output of each stage and if it still won't work post the output to see if we can spot anything.
 
Old 10-24-2006, 06:03 AM   #7
Sleen
Member
 
Registered: Sep 2005
Location: Kampala,Uganda
Distribution: RHEL,FC,SUSE,UBUNTU
Posts: 41

Original Poster
Rep: Reputation: 15
Yes.Actaually,i've done all that and it confirms each step as you list them.Also,the ca and server keys are ok.The problem is just with the client keys,which are 0bytes.
Maybe i should try from scratch again.
Thanks though
 
Old 12-16-2016, 12:21 AM   #8
odielag
LQ Newbie
 
Registered: Aug 2012
Posts: 4

Rep: Reputation: Disabled
I want to know the answer for this also.

I want to know the answer for this also. If I find a solution soon I'll reply here with it.
 
Old 12-16-2016, 01:19 AM   #9
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=15, FreeBSD_12{.0|.1}
Posts: 6,252
Blog Entries: 24

Rep: Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192Reputation: 4192
Quote:
Originally Posted by odielag View Post
I want to know the answer for this also. If I find a solution soon I'll reply here with it.
You have re-opened a thread which was last active more than 10 years ago.

Beginning your own thread with a clear description of your specific problem will give your question better visibility and be more likely to attract current, useful answers.

Please see the Site FAQ for guidance on how to write an effective problem description.
 
Old 12-16-2016, 11:17 AM   #10
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,574
Blog Entries: 4

Rep: Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890
If you get a "zero-length key," here's the answer:

At one point you got a message: failed to update database - error number 2.

"easy-rsa" maintains a database (actually just a text file, keys/index.txt) of keys that it has issued, by common name. If it finds an entry already in this file, it will generate this error, and(!) create a zero-length key file.

Locate the file and remove the entry. (It's just a text file ...) Then retry the entire procedure.

If it worked, you should see data base updated. The file will now have real contents.

... and how do I know this? ...

Last edited by sundialsvcs; 12-16-2016 at 11:18 AM.
 
Old 12-16-2016, 11:59 AM   #11
odielag
LQ Newbie
 
Registered: Aug 2012
Posts: 4

Rep: Reputation: Disabled
For me the solution was to "sudo apt-get remove --purge openvpn easy-rsa" and then reinstall them and follow the directions at... https://vsefer.com/content/install-o...-debian-jessie
 
Old 12-17-2016, 09:33 PM   #12
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,574
Blog Entries: 4

Rep: Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890
Well, of course you can "just detonate a small thermonuclear bomb under easy-rsa and reinstall it," but you don't need to go to such draconian measures to fix a simple (but not at all obvious ...) problem.

Look carefully and you'll see the error message, I think in the certificate-signing step. It's terribly easy to overlook, especially since it does create a (zero length ...) file. (I'm sure that's a bug, but it'll probably never be fixed.)

Last edited by sundialsvcs; 12-17-2016 at 09:34 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
OpenVPN Client can't ping host by name mrpc_cambodia Linux - General 5 07-09-2019 07:39 PM
OpenVPN client has not default gateway when connect to OpenVPN server sailershen Linux - Security 3 03-04-2010 03:20 AM
Openvpn client to client routing question soup Linux - Networking 0 02-16-2006 12:13 PM
OpenVPN client cannot route to LAN TheAmazingSteve Linux - Networking 1 09-29-2005 04:40 PM
inetd and OpenVPN client rmocius@auste.e Slackware 0 10-14-2004 02:50 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:13 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration