I am trying to setup OpenVPN but I am getting this error:

grep: /etc/openvpn/easy-rsa/2.0/openssl.cnf: No such file or directory
pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
version of openssl.cnf: /etc/openvpn/easy-rsa/2.0/openssl.cnf
The correct version should have a comment that says: easy-rsa version 2.x

I have OpenSSL* installed. Do I need to set a location?


it's hard to tell without more information...

anyhow, you have either

  • not properly configured your installation via the vars file

  • or you haven't activated the vars file by running source vars prior to running ./build-ca

the vars file contains (among other things) the definition of the KEY_CONFIG variable. the default (on my Debian system) is to call a wrapper-script which will try to find the correct default openssl.conf file for you

export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`

(on my system i have OpenSSL 1.0.1e 11 Feb 2013 installed, so KEY_CONFIG evaluates to .../openssl-1.0.0.cnf)

if this doesn't work for you, you can manually set the KEY_CONFIG to a value that matches yours.

  • i have the same settup, yet the whichopensslcnf points to the wrong openssl version. i have 1.1.0g installed but only 0.9.6.cnf / 0.9.8.cnf and 1.0.0.cnf. How do i add another openssl.cnf for 1.1.0g? as source vars now gives an error the same as @frank – TD_Nijboer Jan 11 '18 at 8:50
  • 1
    This should not be the accepted answer. – BugHunterUK Nov 14 '18 at 12:43
  • @BugHunterUK [citation needed] – umläute Nov 14 '18 at 19:57

ln -s openssl-1.0.0.cnf openssl.cnf

  • 8
    You should explain why this command should be executed and what was the problem in the first place. Even if it may be obvious. – Raphael Ahrens Dec 4 '13 at 6:29
  • 1
    It's magic, but it works. – Rob Sedgwick Sep 2 '17 at 22:58
  • 1
    just do a ls in the folder, and you will see what openssl-x.x.x.cnf are available... 1.0.0 is the hights, ln -s is a symbolic link... guess that explains it enough? – michel.iamit Nov 26 '17 at 12:26
  • works like magic during my setup of OpenVPN. it creates a link to the current version of openssl – Manny265 Jan 22 '19 at 8:13
  • symbolic link just works. – Alexander Kim Jun 12 '19 at 16:23

By me (Debian 9.3) it works with following entrys

Insert in vars

export KEY_CN="xxx"
export KEY_ALTNAMES=""

then it works fine!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.