Hello,

after some time of valid OpenVPN configuration on Mikrotik CCR1009-8G-1S, v6.37.1 I can't connect.
OpenVPN reports expired certificate:

...

CA and server certificates are valid. Tried to set the same certificate for HTTPS and it was valid.

Any suggestions?

Thanks.

10 years is a long time

Maybe time to update cert?

I know server cert could expire?

You can check expiration with this:

$ echo | openssl s_client -connect urlhere

Is the client certificate signed by the same CA that issued the server certificate?

Yes, it is signed with the same CA. It was working several days ago, now it stopped.
But I double checked all certs and they are valid and signed with that CA.

Yes, it is signed with the same CA. It was working several days ago, now it stopped.
But I double checked all certs and they are valid and signed with that CA.

Weird. I thought it was a wrong error message, but... Ok.

1) The server is a CCR. What is the client?
2) What changed when it stopped working? New RouterOS version? New client version? Some configuration change? Windows update? There must be something.

I'm confused which cert. is reported as expired. By logs, it should be server cert. But how it can work when I switch off client cert authentication? Server cert reported expiration wouldn't allow it.

I'm confused which cert. is reported as expired. By logs, it should be server cert. But how it can work when I switch off client cert authentication? Server cert reported expiration wouldn't allow it.

Just got an idea: the server certificate is valid. But how about the CA certificate? Maybe your server cert is ok, but the CA cert isn't. When You ask to validate the client certificate the system finds out that the CA is no longer valid and complains.

Thu Dec 22 13:16:45 2016 us=67242 OpenSSL: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired

See CRL settings in your root certificate and users! He expired!
NewTerminal.
>certificate crl print
E - expired

Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
 #          NAME            COMMON-NAME            SUBJECT-ALT-NAME
 0 K L A  T CA              <company name>
 1 K    I   SERVER          <public IP address>
 2          CLIENT-tpl      vpnuser
 3 K    I   vpnuser01       vpnuser01
 4 K    I   vpnuser02       vpnuser02
 5 K    I   vpnuser03       vpnuser03
 6 K    I   vpnuser04       vpnuser04
 7 K    I   vpnuser05       vpnuser05
 8 K    I   vpnuser06       vpnuser06
 9 K    I   vpnuser07       vpnuser07
10 K    I   vpnuser08       vpnuser08
11 K    I   vpnuser09       vpnuser09
12 K    I   vpnuser10       vpnuser10
13 K    I   vpnuser11       vpnuser11
14 K    I   vpnuser12       vpnuser12
15 K    I   vpnuser13       vpnuser13
16 K    I   vpnuser14       vpnuser14
17 K    I   vpnuser15       vpnuser15
18 K    I   vpnuser16       vpnuser16
19 K    I   vpnuser17       vpnuser17
20 K    I   vpnuser18       vpnuser18
21 K    I   vpnuser19       vpnuser19
22 K    I   vpnuser20       vpnuser20

Thu Dec 22 13:16:45 2016 us=67242 OpenSSL: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired

See CRL settings in your root certificate and users! He expired!
NewTerminal.
>certificate crl print
E - expired

I printed all certificates with "certificate print". Only removed fingerprint and changed IP address and company name with <...text...>.
There are no expired certificates. CLIENT-tpl is template for new client certificate if needed.
Output:

Code: Select all

Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
 #          NAME            COMMON-NAME            SUBJECT-ALT-NAME
 0 K L A  T CA              <company name>
 1 K    I   SERVER          <public IP address>
 2          CLIENT-tpl      vpnuser
 3 K    I   vpnuser01       vpnuser01
 4 K    I   vpnuser02       vpnuser02
 5 K    I   vpnuser03       vpnuser03
 6 K    I   vpnuser04       vpnuser04
 7 K    I   vpnuser05       vpnuser05
 8 K    I   vpnuser06       vpnuser06
 9 K    I   vpnuser07       vpnuser07
10 K    I   vpnuser08       vpnuser08
11 K    I   vpnuser09       vpnuser09
12 K    I   vpnuser10       vpnuser10
13 K    I   vpnuser11       vpnuser11
14 K    I   vpnuser12       vpnuser12
15 K    I   vpnuser13       vpnuser13
16 K    I   vpnuser14       vpnuser14
17 K    I   vpnuser15       vpnuser15
18 K    I   vpnuser16       vpnuser16
19 K    I   vpnuser17       vpnuser17
20 K    I   vpnuser18       vpnuser18
21 K    I   vpnuser19       vpnuser19
22 K    I   vpnuser20       vpnuser20

No.
Comand certificate crl print
!!...

Thu Dec 22 13:16:45 2016 us=67242 OpenSSL: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired

See CRL settings in your root certificate and users! He expired!
NewTerminal.
>certificate crl print
E - expired

I printed all certificates with "certificate print". Only removed fingerprint and changed IP address and company name with <...text...>.
There are no expired certificates. CLIENT-tpl is template for new client certificate if needed.
Output:

Code: Select all

Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
 #          NAME            COMMON-NAME            SUBJECT-ALT-NAME
 0 K L A  T CA              <company name>
 1 K    I   SERVER          <public IP address>
 2          CLIENT-tpl      vpnuser
 3 K    I   vpnuser01       vpnuser01
 4 K    I   vpnuser02       vpnuser02
 5 K    I   vpnuser03       vpnuser03
 6 K    I   vpnuser04       vpnuser04
 7 K    I   vpnuser05       vpnuser05
 8 K    I   vpnuser06       vpnuser06
 9 K    I   vpnuser07       vpnuser07
10 K    I   vpnuser08       vpnuser08
11 K    I   vpnuser09       vpnuser09
12 K    I   vpnuser10       vpnuser10
13 K    I   vpnuser11       vpnuser11
14 K    I   vpnuser12       vpnuser12
15 K    I   vpnuser13       vpnuser13
16 K    I   vpnuser14       vpnuser14
17 K    I   vpnuser15       vpnuser15
18 K    I   vpnuser16       vpnuser16
19 K    I   vpnuser17       vpnuser17
20 K    I   vpnuser18       vpnuser18
21 K    I   vpnuser19       vpnuser19
22 K    I   vpnuser20       vpnuser20

 #    CERT                                                               LAST-UPDATE                 NUM    REVOKED URL

No certificates are printed:

Code: Select all

 #    CERT                                                               LAST-UPDATE                 NUM    REVOKED URL

Hello,

You have generated certificates with wrong CRL address.
ca-crl-host="127.0.0.1"

Of coures client will not be able to validate certificate because it cannot get CRL from 127.0.0.1

Best regards,
Maris

--
MikroTik.com

I've get answer from Support Team:

Hello,

You have generated certificates with wrong CRL address.
ca-crl-host="127.0.0.1"

Of coures client will not be able to validate certificate because it cannot get CRL from 127.0.0.1

Best regards,
Maris

--
MikroTik.com

Now everything is OK.