OpenSSL

openvpn: error=CRL has expired

2 Comments / Open Source, OpenSSL, ssl-admin / By /

After the former FreshPorts server was retired, its OpenVPN credential were revoked. I maintain those certificates via ssl-admin. I uploaded the new CRL into the System | Certificate Manager | Certificate Revocation page in pfSense. Today, I was seeing strange errors in Nagios, and figured someone wasn’t connected to the VPN. Checking OpenVPN client logs, I found nothing. On the OpenVPN server, I found this message: Oct 23 22:14:23 openvpn 11134 203.0.113.144:20690 VERIFY […]

openvpn: error=CRL has expired Read More »

OpenVPN: unsupported certificate purpose

Leave a Comment / General, OpenSSL, OpenVPN, ssl-admin / By /

See also SSL client vs server certificates and bacula-fd. I use OpenVPN since at least 2008 – now going on 13 years. I find it to be reliable and stable. A few days ago, I added another client to a VPN. I run this particular network with self-signed certificates which I create using ssl-admin – I find it particularly useful for this purpose. The problem Away I went, creating a new certicate, bundled

OpenVPN: unsupported certificate purpose Read More »

SSL client vs server certificates and bacula-fd

Leave a Comment / OpenSSL / By /

See also OpenVPN: unsupported certificate purpose. NOTES NOTE: When using ssl-admin for Bacula: use option 4 (Perform a one-step request/sign) for clients (bacula-fd) use option S (Create new Signed Server certificate) for servers (bacula-sd and bacula-dir) I know these things, but I repeatedly go to option 4 and forget…. Original post follows Sometimes I forget about TLS / SSL / x509 certificates being available in both server and client versions, particularly when it

SSL client vs server certificates and bacula-fd Read More »

acme.sh: getting free SSL certificates – installation configuration on FreeBSD

Leave a Comment / Let's Encrypt, named, nsupdate, OpenSSL, Security / By /

This blog post describes my Let’s Encrypt solution which uses acme.sh and dns-01 challenges to obtain SSL certificates. If you are using HTTP challenges, this post might still be useful, but your configuration will differ slightly. Let’s Encrypt is a certificate authority which has become wildly popular since it was launched in April 2016 (just a short 14 months ago). Why so popular? It provides a secure way to offer free SSL certificates.

acme.sh: getting free SSL certificates – installation configuration on FreeBSD Read More »

Scroll to Top