9

I am trying to setup OpenVPN but I am getting this error:

#./build-ca
grep: /etc/openvpn/easy-rsa/2.0/openssl.cnf: No such file or directory
pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
version of openssl.cnf: /etc/openvpn/easy-rsa/2.0/openssl.cnf
The correct version should have a comment that says: easy-rsa version 2.x

I have OpenSSL* installed. Do I need to set a location?

Improve this question

3 Answers 3

Reset to default
48

ln -s openssl-1.0.0.cnf openssl.cnf

Improve this answer
6
  • 9
    You should explain why this command should be executed and what was the problem in the first place. Even if it may be obvious.
    – Raphael Ahrens
    Dec 4, 2013 at 6:29
  • 1
    It's magic, but it works.
    – Rob Sedgwick
    Sep 2, 2017 at 22:58
  • 1
    just do a ls in the folder, and you will see what openssl-x.x.x.cnf are available... 1.0.0 is the hights, ln -s is a symbolic link... guess that explains it enough?
    – michel.iamit
    Nov 26, 2017 at 12:26
  • works like magic during my setup of OpenVPN. it creates a link to the current version of openssl
    – Manny265
    Jan 22, 2019 at 8:13
  • symbolic link just works.
    – Alexander Kim
    Jun 12, 2019 at 16:23
1

it's hard to tell without more information...

anyhow, you have either

  • not properly configured your installation via the vars file

  • or you haven't activated the vars file by running source vars prior to running ./build-ca

the vars file contains (among other things) the definition of the KEY_CONFIG variable. the default (on my Debian system) is to call a wrapper-script which will try to find the correct default openssl.conf file for you

export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`

(on my system i have OpenSSL 1.0.1e 11 Feb 2013 installed, so KEY_CONFIG evaluates to .../openssl-1.0.0.cnf)

if this doesn't work for you, you can manually set the KEY_CONFIG to a value that matches yours.

Improve this answer
3
  • i have the same settup, yet the whichopensslcnf points to the wrong openssl version. i have 1.1.0g installed but only 0.9.6.cnf / 0.9.8.cnf and 1.0.0.cnf. How do i add another openssl.cnf for 1.1.0g? as source vars now gives an error the same as @frank
    – Nijboer IT
    Jan 11, 2018 at 8:50
  • 1
    This should not be the accepted answer.
    – BugHunterUK
    Nov 14, 2018 at 12:43
  • @BugHunterUK [citation needed]
    – umläute
    Nov 14, 2018 at 19:57
0

By me (Debian 9.3) it works with following entrys

Insert in vars

export KEY_CN="xxx"
export KEY_ALTNAMES=""

then it works fine!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .