Hi,
On 27/11/2023 11:49, Gert Doering wrote:
Hi,
On Mon, Nov 27, 2023 at 10:47:17AM +0100, Aleksandar Ivanisevic wrote:
2023-11-26T08:33:40.015885+01:00 xxx openvpn[7996]: xxx:6013 OpenSSL:
error:0308010C:digital envelope routines::unsupported
So this sounds like "the CRL is built using old algorithms" (MD5?), and
it might work if you do "providers legacy default" in the server config.
2023-11-26T08:33:40.016558+01:00 xxx openvpn[7996]: xxx:6013 OpenSSL:
error:0480006C:PEM routines::no start line
2023-11-26T08:33:40.017053+01:00 xxx openvpn[7996]: xxx:6013 CRL: cannot read
CRL from file /config/vpn/my.crl
2023-11-26T08:33:40.017486+01:00 xxx openvpn[7996]: xxx:6013 CRL: loaded 1 CRLs
from file /config/vpn/my.crl
Now *this* sounds like OpenVPN is lying, which would be a serious bug...
we must be iterating twice. there is no way to get the counter increased
to 1 if an error was returned in the first place.
Maybe we are getting an empty CRL the first time.
Although I can't understand how we are getting "no start line" and then
"CRL: cannot read CRL from file". The first error should imply an early
exit if the counter is 1.
@Aleksandar would it be an option for you to send your CRL over so that
we can replicate the issue here (also privately)?
Cheers,
--
Antonio Quartulli
_______________________________________________
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
