OpenVPN: 'Private key password verification failed' with verified config

Question

I installed OpenVPN with:

$ sudo apt-get install openvpn

I then run the client with the config file I received from my company.

$ sudo openvpn --config myconfig.ovpn

The config has been verified working on a colleague's machine. But one exception: My colleague is using a Windows system, I'm using Debian.

Error

Fri Jul 27 11:33:34 2018 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Fri Jul 27 11:33:34 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Fri Jul 27 11:33:34 2018 Error: private key password verification failed
Fri Jul 27 11:33:34 2018 Exiting due to fatal error

Prerequisites

• Debian Stretch LXDE (latest)
• No server environment installed
• No Pre-VPN environments installed

Contents of the config

client
dev tun
proto udp
remote example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_pZFAVxw3z2VPJhKI name
cipher AES-256-CBC
auth SHA256
compress lz4
verb 3
<ca>
-----BEGIN CERTIFICATE-----
<<base64>>
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
<<base64>>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,C6B57204A2ECC239
<<base64>>
-----END RSA PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
<<base64>>
-----END OpenVPN Static key V1-----
</tls-crypt>

The official OpenVPN manual recommends my way of trying to run it. So I'm out of knowledge what the problem could be and seeking for help.

What could be the reason for the error?

Answer 1

After some trying with another Linux-System I found out there was of course a problem with the used private key password d;.Jo$HhqA2l7yMd :Wx.

If one ever creates a configuration the private key inside <key></key> should be extracted in a separate file and then verified with openssl rsa -in client.key -check afterwards.

I don't know what exactly caused the password to fail. I tried several new configurations with random passwords and neither a $ nor a whitespace caused a fail again.

Interesting is also the fact that on a windows system the password was accepted.

Answer 2

I'm facing the same issue here today.

My current os is Fedora 36 (beta) and is using openvpn version 2.5.6 from the dnf package manager.

The problem arise when I tried to perform the command same as yours

$ sudo openvpn --config myconfig.ovpn

The reason I found out is because I notice that in my another laptop, I was using an older version of openvpn (2.4.9) which has a dependency of openssl version 1, instead of the openssl version 2 used in the latest version.

So my solution to this is downgrade the version of your openvpn (not recommended, but if you want to solve the problem).