Posted: Thu Jan 14, 2010 21:24 Post subject: OpenVPN error=certificate is not yet valid
trying to setup openvpn daemon on build13064 following the "easy VPN" tutorial in the wiki and getting the following error logged in /var/log/messages:
Code:
Jan 14 15:08:13 DD-WRT daemon.notice openvpn[1548]: 192.168.1.166:4822 TLS: Initial packet from 192.168.1.166:4822, sid=afa1a9d5 d9331068
Jan 14 15:08:13 DD-WRT daemon.err openvpn[1548]: 192.168.1.166:4822 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=US/ST=MO/L=STL/O=private/OU
=home/CN=server/emailAddress=none@none.com
I've checked the dates on certificates - valid, issuing server, dd-wrt, and the client - and they're all synced from the same internal time source correctly.
dd-wrt wan = 192.168.1.65
dd-wrt lan = 192.168.2.0/24
openvpn client connects to 192.168.1.65 from 192.168.1.0/24 network.
my server-side openvpn.conf:
Code:
mode server
proto udp
port 1194
dev tap0
server-bridge 192.168.2.1 255.255.255.0 192.168.2.50 192.168.2.100
# Gateway (VPN Server) Subnetmask Start-IP End-IP
keepalive 10 120
daemon
verb 5
client-to-client
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
float
client-side conf (openVPN GUI):
Code:
remote 192.168.1.65 1194
tls-client
dev tap0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert client1.crt
key client1.key
dh dh1024.pem
ns-cert-type server
I have tried re-issuing all of the certs, but still the same error... Is there anything else i can try?
Joined: 08 Jun 2006 Posts: 247 Location: Prince Edward Island - Canada
Posted: Fri Jan 15, 2010 19:32 Post subject:
MajesticPete wrote:
Yup, both ends pull time from the same time source (windows DC) and are completely in sync
I found that in some instances the gmt time was used on the certs for signing but the local time was used to check the values.. in other words the certs did not become valid until (in my case) 4 hours after I created them.
Yes, UTC with no daylight savings is the best setting in respect to setting a proper system time. It seems that uclibc from DD-WRT has been stripped of some code and does not support other timezones, therefore programs which rely upon knowing the proper time fail. _________________ 2 times APU2 Opnsense 21.1 with Sensei
2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)
3 times Asus RT-N16 shelved
E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)
3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)
