Unable to connect a client to OpenVPN pfsense 2.3
I am trying to configure users to get connection to my office, but no matter how I do it I get the error
Mon Apr 25 11:07:01 2016 OpenVPN 2.3.2 x86_64-mandriva-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Feb 9 2014 Mon Apr 25 11:07:01 2016 WARNING: file 'key.key' is group or others accessible Mon Apr 25 11:07:01 2016 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.X:1194 [nonblock] Mon Apr 25 11:07:02 2016 TCP connection established with [AF_INET]XXX.XXX.XXX.X:1194 Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link local (bound): [undef] Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.X:1194 Mon Apr 25 11:07:02 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: C=CO, ST=bogota, L=bogota, O=mdc, emailAddressemail@example.com, CN=internal-ca Mon Apr 25 11:07:02 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Mon Apr 25 11:07:02 2016 TLS Error: TLS object -> incoming plaintext read error Mon Apr 25 11:07:02 2016 TLS Error: TLS handshake failed Mon Apr 25 11:07:02 2016 Fatal TLS error (check_tls_errors_co), restarting Mon Apr 25 11:07:02 2016 SIGUSR1[soft,tls-error] received, process restarting ^CMon Apr 25 11:07:04 2016 SIGINT[hard,init_instance] received, process exiting
I am not using TLS, but the shared key export tool, include the line tls-auth ta.key no matter what so I disable it on the client config file. If I use tls on the server config settings doesn't work either. This has never happened to me before I have been using it for a long time but now I am creating a new server so I downloaded the latest version and then upgraded to 2.3.
so you want road warriors to connect to your pfsense machine running openvpn.. did you run through the wizard.. Getting a openvpn server up and running is really a hand full of clicks.. Wizard walks you through the process.
More than likely you have the wrong cert setup.
Your clients are using a very old version of openvpn btw… 2.3.2 was like 2013..
hedi last edited by
you must check your CA, it must be a server certification and the other one a user certification.
Running through the wizard pretty much makes it impossible to mess up… You create the CA, then the server cert, etc..
It does not work with the wizard either, so it's kind of weird…
No one read/notice this error?
VERIFY ERROR: depth=1, error=certificate is not yet valid:
Check your certificates, date, time.
Your clients have the wrong certs from your openvpn config then? As I mentioned before your clients are quite OLD.. 2.3.2 is very OLD client…
How are you configuring the client?? Do you have access to your key file?
"11:07:01 2016 WARNING: file 'key.key' is group or others accessible"
The certs dates are
Valid From: Thu, 28 Apr 2016 12:59:10 -0500 Valid Until: Sun, 26 Apr 2026 12:59:10 -0500
I download the Viscosity files from the client export and run "openvpn config.conf" as I have been doing before. :'(
You start this thread on April 25, 2016, 06:09:56 pm and your certificate is
Valid From: Thu, 28 Apr 2016 12:59:10 -0500
Maybe today you will be lucky :)
"error=certificate is not yet valid"
good catch.. So your time on your pfsense is OFF would seem, if you ran through the wizard and created those dates..
Dude I have erased and created the certs a lot, the last time was today….
The log message you posted…. never mind.
I also see version 2.3.2 eurephia version, try the latest if possible, dude
guys, i have recorded what I do to configure so please check out here and tell me what I am doing wrong.
I tried watching that.. its horrific… Why don't you just take some screen shots, and post them?? Vs that up and down, its so freaking blurry can not even tell what your doing..
Why are you trying to use the viscosity config in a linux client?
Almost 3 years… ;)
Sorry to all, but my problem was not the version… I had my timezone set to "Universal", so the error=certificate is not yet valid was the mismatch between the server and my computer's time
Both versions of openvpn 2.3.2 and 2.3.10 now work fine.
Thank you to all you people.
One last question, where do I put a label to the post as resolved?
divsys last edited by
Go to your first posted message and click "Modify", change the title to add "[Solved]".
Being in different timezones is not a problem.. But having the wrong time while your in a timezone sure going to have a problem ;)
Why you should always sync off ntp ;) Which set your time correct for the timezone your in..
But you still have a really OLD client, why would you not updated that… But maybe its because your running on a linux distro that last update was what 2011?