5

I bought a Raspberry Pi 3 Model 3 to set up a VPN server, following this guide: https://sys.jonaharagon.com/2016/05/12/setting-up-an-openvpn-server-on-a-raspberry-pi-2-part-12/

When I finished, I was able to get my .ovpn file and imported it to the OpenVPN client, but I got this error:

Fri Apr 14 14:46:11 2017 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Fri Apr 14 14:46:11 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Fri Apr 14 14:46:11 2017 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Fri Apr 14 14:46:11 2017 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no 
start line
Fri Apr 14 14:46:11 2017 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Fri Apr 14 14:46:11 2017 Cannot load inline certificate file
Fri Apr 14 14:46:11 2017 Exiting due to fatal error

Being really new to programming, I have no idea what this is saying. Can someone help me what I did wrong?

5

Welcome to the wonderful world of OpenSSL error messages; they can be mysterious and sometimes incomprehensible even to experienced developers.

In this case, the key lines are:

OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no 
OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Cannot load inline certificate file
Exiting due to fatal error

The first gives you a clue that it's trying to read PEM data; this is the data format typically used for SSL certificates. The second and third lines make it clear that it's trying to load a certificate and failing. The last line makes it clear that it ain't gonna run unless you supply such a certificate.

It doesn't say here exactly what file it's trying to load, but if you go through all the certificate files you've configured for OpenVPN, checking each of them, you'll probably soon figure out what's missing. There would definitely need to be a server key and certificate, which is the most likely cause of this; there may also be client certificates to tell the server what clients are allowed to connect.

Given a configuration line along the lines of ServerCert /etc/pki/foo/mycert.pem (this is probably not OpenVPN syntax), you could check to see if the certificate file exists and actually has a certificate in it with

openssl x509 -noout -text -in /etc/pki/foo/mycert.pem

(This will also display useful information about the certificate, such as the identity, who signed it, the validity dates, and so on. Be particularly careful to check the date range for which the cert is valid as that's a common source of authentication breaking.)

Note that if a file has multiple certificates (it has more than one -----BEGIN CERTIFICATE----- line) this will display only the first one. You can copy the file and edit it to remove the first certificate to display the next one.

This is not at all a Raspberry Pi-specific question but an OpenVPN one generic to any Linux system, so if this answer still leaves you confused you should probably start by checking the more Linux-oriented Stack Exchanges for questions about similar problems.

  • Hey Curt, I finally got the account merged so I can comment your answer, so I went to the folders where the .pem files are, and I find 01.pem and 02.pem. Is this what I am suppose to find? – Cahn-or Apr 21 '17 at 2:03
  • I have no idea. That question has nothing to do with Raspeberry Pi: it's strictly an OpenVPN question. – Curt J. Sampson Apr 21 '17 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.