Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I cannot get OpenVPN to work with GNOME NetworkManager.

Authentication-Type is "Certificates (TLS)"

I have 3 files:

  • UserCert: user.crt
  • CACert: ca.key
  • PrivateKey: user.key

All live in my home-directory. Connection fails with the following message:

Feb 25 23:16:49 archpad nm-openvpn[1138]: OpenVPN 2.3.2 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6
Feb 25 23:16:49 archpad nm-openvpn[1138]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.n
Feb 25 23:16:49 archpad nm-openvpn[1138]: NOTE: the current --script-security setting may allow this configuration to call user-defi
Feb 25 23:16:49 archpad nm-openvpn[1138]: WARNING: file '/home/mak/Downloads/user.key' is group or others accessible
Feb 25 23:16:49 archpad nm-openvpn[1138]: Cannot load CA certificate file /home/mak/Downloads/ca.key (OpenSSL)
Feb 25 23:16:49 archpad nm-openvpn[1138]: Exiting due to fatal error
Feb 25 23:16:49 archpad NetworkManager[422]: <warn> VPN plugin failed: 1
Feb 25 23:16:49 archpad NetworkManager[422]: <info> VPN plugin state changed: stopped (6)
Feb 25 23:16:49 archpad NetworkManager[422]: <info> VPN plugin state change reason: 0
Feb 25 23:16:49 archpad NetworkManager[422]: <info> Policy set 'tb303' (wlp3s0) as default for IPv4 routing and DNS.
Feb 25 23:16:49 archpad NetworkManager[422]: <warn> error disconnecting VPN: Could not process the request because no VPN connection

UPDATE

Output of

openssl x509 -in  /home/mak/Downloads/ca.key -noout -text

is

unable to load certificate
140493069354640:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE
share|improve this question

1 Answer 1

up vote 2 down vote accepted

This one is the fatal error:

Cannot load CA certificate file /home/mak/Downloads/ca.key 

There are a couple reasons that it may not be able to load the key:

  1. Permissions are wrong. Check to make sure the file is readable
  2. File doesn't exist. Confirm the path & name is correct.
  3. File is in the wrong format, or is not a CA certificate. Try openssl x509 -in /usr/local/share/ca-certificates/MetricsCA.crt -noout -text Make sure it spits out something starting 'Certificate:', that the current date/time is inside the validity, and that it has 'CA:TRUE' as one of the basic constraints.
share|improve this answer
    
updated my answer with the output of openssl, seems there´s something wrong with my cert?!? –  sine Feb 26 at 18:30
    
@sine Yep. If you look at the certificate file (its plain text) it should start with -----BEGIN CERTIFICATE-----, or at least have a line reading that. I suspect yours doesn't. –  derobert Feb 26 at 18:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.