Topic: OpenVPN on SME 7.0 (SOLVED)

[Teviot]

I need some help.  I have tried to install OpenVPN using the instructions found at http://sme.swerts-knudsen.dk/index.html?frame=http%3A//sme.swerts-knudsen.dk/howtos/howto_30.htm.

My problem is, I get an error at the client key stage

Certificate is to be certified until Oct 15 05:40:43 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2

Can anyone help?

Adrian

[Happy]

I got the same error.
The other steps worked fine though...

[william_syd]

Are you creating a master certificate and a client certificate with the same domain names ?

[william_syd]

Just ran through it no problem..

Info in Server certificate...

Code: [Select]

The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'New South Wales'
localityName          :PRINTABLE:'Sydney'
organizationName      :PRINTABLE:'MagicWilly'
organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'Server'
emailAddress          :IA5STRING:'william@xxx.info'
Certificate is to be certified until Oct 15 08:21:54 2016 GMT (3650 days)


and Client certificate...

Code: [Select]

The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'New South Wales'
localityName          :PRINTABLE:'Sydney'
organizationName      :PRINTABLE:'MagicWilly'
organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'Client'
emailAddress          :IA5STRING:'william@xxx.info'
Certificate is to be certified until Oct 15 08:23:13 2016 GMT (3650 days)


Note the organizationalUnitName and commonName. commonName has to be different.

You may have to delete these files to start again..

Code: [Select]

/etc/openvpn/easy-rsa/keys/index.txt
/etc/openvpn/easy-rsa/keys/index.txt.old


[Teviot]

William

Just followed the instructions again deleteing the files you suggested and came up with the same results.

Code: [Select]

[root@gateway easy-rsa]# rm /etc/openvpn/easy-rsa/keys/index.txt
rm: remove regular file `/etc/openvpn/easy-rsa/keys/index.txt'? y
[root@gateway easy-rsa]# rm /etc/openvpn/easy-rsa/keys/index.txt.old
rm: remove regular empty file `/etc/openvpn/easy-rsa/keys/index.txt.old'? y
[root@gateway easy-rsa]# pico vars

   UW PICO(tm) 4.10                                            File: vars                                                Modified  

# Edit this variable to point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl.cnf

# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR=/etc/openvpn/easy-rsa/keys

# Increase this to 2048 if you
# are paranoid.  If you do increase,
# make sure you build OpenVPN with
# pthread support, so you don't incur
# any performance penalty.
export KEY_SIZE=1024

# These are the default values for fields
# which will be placed in the certificate.
export KEY_COUNTRY=AU
export KEY_PROVINCE=NSW
export KEY_CITY=xxxx
export KEY_ORG=" xxxxxx xxxxxxxx "
export KEY_EMAIL="netadmin@xxxxxx"


                                                         [ Wrote 29 lines ]

[root@gateway easy-rsa]# . vars
[root@gateway easy-rsa]# ./clean-all
[root@gateway easy-rsa]# ./build-ca
Generating a 1024 bit RSA private key
...........++++++
............................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [NSW]:NSW
Locality Name (eg, city) [xxxx]:xxxx
Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx
Organizational Unit Name (eg, section) []:VPN
Common Name (eg, your name or your server's hostname) []:gateway
Email Address [netadmin@teviot.net]:netadmin@xxxxxx
[root@gateway easy-rsa]# ./build-key server
Generating a 1024 bit RSA private key
.........++++++
..++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [NSW]:NSW
Locality Name (eg, city) [xxxx]:xxxx
Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx Organizational Unit Name (eg, section) []:VPN
Common Name (eg, your name or your server's hostname) []:gateway
Email Address [netadmin@xxxxxx]:netadmin@xxxxxx

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'NSW'
localityName          :PRINTABLE:'xxxx'
organizationName      :PRINTABLE: xxxxxx xxxxxxxx '
organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'gateway'
emailAddress          :IA5STRING:'netadmin@xxxxxx'
Certificate is to be certified until Oct 15 08:43:42 2016 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@gateway easy-rsa]# ./build-key client
Generating a 1024 bit RSA private key
.....................................................................++++++
.......++++++
writing new private key to 'client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [NSW]:NSW
Locality Name (eg, city) [xxxx]:xxxx
Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx
Organizational Unit Name (eg, section) []:VPN
Common Name (eg, your name or your server's hostname) []:gateway
Email Address [netadmin@xxxxxx]:netadmin@xxxxxx

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'AU'
stateOrProvinceName   :PRINTABLE:'NSW'
localityName          :PRINTABLE:'xxxx'
organizationName      :PRINTABLE: ' xxxxxx xxxxxxxx '
organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'gateway'
emailAddress          :IA5STRING:'netadmin@xxxxxx'
Certificate is to be certified until Oct 15 08:45:15 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
[root@gateway easy-rsa]#


I have no idea where to go from here

Adrian

[william_syd]

Did you use gateway as the commonname for the server and client certificates ?

And post as code not quote.. it formats better.

[Teviot]

yes ... gateway was used the whole way though

[william_syd]

yes ... gateway was used the whole way though

Did you read and understand my previous post...?

commonName has to be different.

[Teviot]

I think I ubderstand now

i used the following

Code: [Select]

organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'gateway'

[william_syd]

I think I ubderstand now

i used the following

Code: [Select]

organizationalUnitName:PRINTABLE:'VPN'
commonName            :PRINTABLE:'gateway'

Nooo....

Read the howto.. at some stage you make a Server certificate and then a Client certificate.

The CommonName has to be different for each.

[byte]

Moving this topic to the SME 7.x Contribs forum, it is more appropriate there. Thanks!

[Teviot]

Thats what I've been doing and every time it fails on the client key part.  I don't understand where i'm going wrong

Adrian

[william_syd]

Thats what I've been doing and every time it fails on the client key part.  I don't understand where i'm going wrong

Adrian

Your example above shows you using 'gateway' for both.

Do

Code: [Select]

./clean-all and start again from

Code: [Select]

./build-ca

Your asked for CommonName 3 times. The first two are the same, the third one must be different.

[Teviot]

Sorry for being so thick.  I now realise AGAIN that to READ the instructions is always a good thing.

Install i now progressing well.

[william_syd]

Sorry for being so thick.  I now realise AGAIN the to read the instructions is always a good thing.

Install i now progressing well.

No problems. Considering 2 people had this problem maybe you want to write the author of the how to and ask him to add this problem/solution to the bottom of his how to in the FAQ section.

Also add to the title - [solved].