I'm setting up an OpenVPN server and I need a little info: do I need to copy the server's ca.crt to the client?
I have tried both ways and only when I do that I can get it working; I would like to know whether what I've done is correct because otherwise do I need to build the certificate on the client-side (./build.ca) just for the client.crt?

2 Answers 2


Your client has to accept the ca-chain of your server.

So if you are using a selv made certificate that is the way to go.

Update: Further reading about ca-chains and root-CAs.

  • May you give me some reference where I can read more about?
    – edmz
    Jan 27, 2014 at 15:38
  • 1
    @black I found a good starting point and added the link to my answer.
    – Nils
    Jan 29, 2014 at 9:31

Generate ca.crt on th server side. And yes, you have to copy it by the client side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .