-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello,
last year i created my keys, certs and so on with the following steps: ##### Serverside ######## openssl req -new -x509 -newkey rsa:2048 -keyout ssl_priv.pem -out ca_cert.pem -days 3650 -config ./openssl.conf openssl x509 -in ca_cert.pem -out ca_cert.crt openssl genrsa -out serverkey.pem -aes128 2048 -days 3650 -config ./openssl.conf openssl req -new -key serverkey.pem -out req.pem -nodes -config ./openssl.conf openssl ca -keyfile ssl_priv.pem -cert ca_cert.pem -in req.pem -notext - -out servercert.pem -config ./openssl.conf And today my certificate is invalid, cause due an "error" the servercert.pem is only valid 365 days. It should be 3650 days. ##### Serverside created, but copied to every client ######## With the following commands i created the client certificates and keys openssl req -new -keyout clients/client-key-XXXXX.pem -out clients/client-req-XXX.pem -days 365 -config ./openssl.conf openssl ca -keyfile ssl_priv.pem -cert ca_cert.pem -in clients/client-req-XXX.pem -notext -out client-cert-XXX.pem -outdir clients -config ./openssl.conf mv client-*.pem clients/ The Client certificates are also invalid due the same lack of my scripts. The clients are not accessable per remote maintenance cause they are umts clients with non static ip. Is there any possibility to extend the certificates, keys and so on server-side WITHOUT any change at client-side? Thanks for every hint, Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCgAGBQJTHG73AAoJEFF6fE6T32A8COgH/RIxPLXvS4V9nmdOc5qwlHMx wj0FEteasG3ejnIqDebtDnW7AZBSeMbK8ZJQTByX+wnVj6OFVeXXFUtXTyR++4AC kj2JIDaMfPtcMh0IPuBCAOTjLII2kUOVz/xlPo/oibJH4P9mTTnhJ07932uD50ca APvrCCDM/atdpVzs2EXn73sWUlkgMDSDJLHYCUolCk7wL+L78mF1KU17HaPcVL7+ Hs16j9q/Ty5PjbYLnAfNFC0ydG2yeKAQLTnr7te/0QrLmU+IxifNX8UA5UoYVPrJ /5m/ApCGdZofzoMvIHfO8i3VB2aO/s/ECgzFezw0k8es1ZWaByWbhgan4qxFjUk= =SloG -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. With Perforce, you get hassle-free workflows. Merge that actually works. Faster operations. Version large binaries. Built-in WAN optimization and the freedom to use Git, Perforce or both. Make the move to Perforce. http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
