Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, I'll explain what I did... and at the end is the queston. THank you!

To set up my VPN I installed OpenVPN in server and client machines. On server I configured the cert Authority in the file /etc/openvpn/easy-rsa/vars editing this lines:

export KEY_CITY=”Madrid”
export KEY_ORG=”My Organization”
export KEY_EMAIL=””

then i generated the cert:

cd /etc/openvpn/easy-rsa/ ln -s openssl-1.0.0.cnf openssl.cnf source vars ./clean-all ./build-ca

Created the cerver certs:

./build-key-server myServer

Diffie Hellman parameters to server


Copyed certs and keys /etc/openvpn

cd keys/ cp myServer.crt myServer.key ca.crt dh1024.pem /etc/openvpn/

Created client Certs

cd /etc/openvpn/easy-rsa/ source vars ./build-key client1

Copied this certs to client machine and erased them from server:




Edited /etc/openvpn/server.conf to my files names

ca ca.crt
cert myServer.crt
key myServer.key
dh dh1024.pem

/etc/init.d/openvpn restart

Verified that tun0 is there

ifconfig tun0

Enabled ip_forward parameter on /etc/sysctl.conf so packages may flow


Also enabled virtual network masking so client may access all remote machines

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

and saved the ip tables conf so they dont desappear in a reboot

Grabamos la configuración en un fichero

sudo sh -c “iptables-save > /etc/iptables.rules”

Edit /etc/network/interfaces adding the interface (eth0 in this case)

pre-up iptables-restore < /etc/iptables.rules

In the client i installed OpenVPN and edited the client.conf file which is in /etc/openvpn with the certs: ca.cert, client1.key, client1.conf getting the following client.conf file:

dev tun
proto udp
remote 1194
resolv-retry infinite
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
verb 3

then restarted:

/etc/init.d/openvpn restart

And when i want to verify that the interface tun0 is there with ifconfig tun0, there is not.

So I checked my log for errors, in the client machine and there is this error:

VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=Es/ST=M/L=Madrid/O=xxx/OU=xxx/CN=myServer/name=xxx/
TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
user openvpn[7984]: TLS Error: TLS object -> incoming plaintext read error
user openvpn[7984]: TLS Error: TLS handshake failed

I've created the keys again, and added the full path of the certs in the client.conf file but it still doesn't work. Also tryed with all my firewalls disabled and still cant conect to my server because of that error.

Another important thing is that my server is an ubuntu 12.04 and client CentOS 6.3

I can see that i find my server but still the connection isn't completed...

What should I do??

If any more config files are needed, tell me to show you

share|improve this question
I have exactly the same problem. Many hours of googling have turned up only the unhelpful suggestions of regenerating the certificates (they were working, and still valid), or open the firewall (was working, connections ok). Random poking has not helped either. – Thomas Jones-Low Feb 24 '14 at 17:49

In your error message:

error=unable to get local issuer certificate: 

This message means these lines in your client configuration are pointing to the wrong files:

cert client1.crt
key client1.key

In your building the client keys, you said:


You need to update the client configuration to match the names of the .crt and .key file actually generated

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .