OpenVPN

Zdravím,

již delší dobou pročítám nejrůznější manuály na setup OpenVPN.
Zjistil jsem plno zajímavých věcí na základní nastavení, ale stále se mi nedaří.
Podařilo se mi už párkrát nastavit obyč TUN spojení, které bylo úspěšně navázáno jen pomocí statického klíče, ale nemohl jsem ping virtual IP VPN sítě. Zkoušel jsem i generování certifikátů ale píše mi to plno nesmyslů (soubor nenalezen atd.).

Pracuji ve Win (XP a 7) a chci se naučit kompletnímu používání tohoto prg.

Proto píši sem a žádám o pomoc.

Rád bych se spojil s někým, např. po skypu, kdo by si na mě udělal čas (přes týden odpol. o víkend kdykoli) a pomohl mi, mě provést kompletní konfigurací OpenVPN.

Napište mi prosím na mé uvedené kontakty v profilu.

Děkuji předem všem za pozitivní postoj a odpovědi.

B.R.

Prvni a zasadni rada, co se tyce openvpn na windows je: DON'T! ;D ;D
Na generovani certifikatu maji sadu utilitek easy-rsa, v podstate zeditujes openssl.cnf a vars, ty si includnes (na windows nevim jestli to je), a pak si tusim vygenerujes dh, svoji ca (build-dh, build-ca), crt/key pro server (build-key-server) a pak uz jen generujes crt/key pro klienty (build-key). Config bude trochu odlisnej, protoze widle maj nejaky problemy s routovanim, a tusim se musi pouzit tap a ne tun.

Tady je nejakej postup: http://www.runpcrun.com/howtoopenvpn

Citace:

---

Původně odeslal admix

Prvni a zasadni rada, co se tyce openvpn na windows je: DON'T! ;D ;D
Na generovani certifikatu maji sadu utilitek easy-rsa, v podstate zeditujes openssl.cnf a vars, ty si includnes (na windows nevim jestli to je), a pak si tusim vygenerujes dh, svoji ca (build-dh, build-ca), crt/key pro server (build-key-server) a pak uz jen generujes crt/key pro klienty (build-key). Config bude trochu odlisnej, protoze widle maj nejaky problemy s routovanim, a tusim se musi pouzit tap a ne tun.

Tady je nejakej postup: http://www.runpcrun.com/howtoopenvpn

---

vim vim.. taky jsem sveho casu delal v linuxu..ale ve firme to chtej na widle.. a tak to studuju..

zasadni problem na ktery jsem pri generovani CA narazil je chybejici soubor openssl.cnf . Ten jsem svym zpusobem nejak dostal do adr OpenVPN ale pri dalsich krocich to rvalo X dalsich hlasek o chybnych cestach atd.. proto heldam nekoho kdo by mi s tim pomohl online :(

Kdyz nadefinujes "X dalsich hlasek", tak ti poradim :)

Tomu rikam tedy zaujatost :)
Ale pravda pro firemni (sirsi) vyuziti je ten linux uz asi lepsi, v domacich podminkach Win bohate staci.

S generovanim jsem potize pod win nemel, jen nainstaloval a generoval (Win7 naposledy).
Myslim ze to bylo podle tohoto navodu http://openvpn.net/index.php/open-so...howto.html#pki
Se samotnym nastavenim nejlip kdyz sem das konfigurak a my Ti ho zkritizujem, v lepsim pripade i opravime :)

Citace:

---

Původně odeslal admix

Kdyz nadefinujes "X dalsich hlasek", tak ti poradim :)

---

mohu se ti popripade ozvat na skype.. ?... ze bychom to dali krok za krokem ?.. treba prijdem na to kde delam chybu..

postupuju pri generovani certifikatu ve win dle teto web adr

pisni mi pls na skypu.. pokud bys souhlasil..dekuji

Citace:

---

Původně odeslal HollyG

Tomu rikam tedy zaujatost :)
Ale pravda pro firemni (sirsi) vyuziti je ten linux uz asi lepsi, v domacich podminkach Win bohate staci.

S generovanim jsem potize pod win nemel, jen nainstaloval a generoval (Win7 naposledy).
Myslim ze to bylo podle tohoto navodu http://openvpn.net/index.php/open-so...howto.html#pki
Se samotnym nastavenim nejlip kdyz sem das konfigurak a my Ti ho zkritizujem, v lepsim pripade i opravime :)

---

dekuji za moznost.. ale rad bych to bral postupne.. nejprve chci zvladnout generovani certifikatu.. konfiguraky bych popripade resil pote.. :-)

Pres skype ti tezko nekdo bude radit, proste sem pastni z terminalu, co poustis, co to hlasi a pripadne config toho co nejde ;)

Tohle forum tu neni od toho, aby sis sehnal free support na skype. Jestli chces neco resit a neni to extremne komplikovany (jakoze openvpn neni), tak to res tady, at z toho benefituji i ostatni.
Nebo si dej nabidku do nabidek prace.

Citace:

---

Původně odeslal Fox!MURDER

Tohle forum tu neni od toho, aby sis sehnal free support na skype. Jestli chces neco resit a neni to extremne komplikovany (jakoze openvpn neni), tak to res tady, at z toho benefituji i ostatni.
Nebo si dej nabidku do nabidek prace.

---

sry mno :( myslel jsem to v dobrem.. ale souhlasim :(

i tak bych po uspesnem dokonceni veskerych konfiguraci treba udelal nejakou web str na OpenVPN ve win pro vsechny ;)

Citace:

---

Původně odeslal Black Reider

i tak bych po uspesnem dokonceni veskerych konfiguraci treba udelal nejakou web str na OpenVPN ve win pro vsechny ;)

---

Což ti stále nebrání ty kroky vypsat SEM a řešit to tady a tu stránku udělat i tak ;-)

Bud resi neco ultrasupertajnyho, nebo se proste stydi, protoze mu to nefunguje. To je celkem normalni jev, delam to taky ;D

OK dotaz c.1

na pocatku gen. CA se ve win zacina spustenim init-config z adr ...\OpenVPN\easy-rsa\, ktery v adr vytvori (popripade prepise existujici) vars.bat a openssl.cnf

proc se mi teda objevi jen vars.bat a openssl.cnf vubec? Openssl.cnf neni ani jako skryty soubor a bez tohoto souboru jsou dalsi postupy pro generovani k nicemu.

Na jake verzi Vam to slape?.. at netvorim zbytecne VPN na problemove verzi prg.

tak se predvedte co poradite :-)

Ted jsem si stahnul widli verzi, a tam openssl.cnf je uz z vyroby

Kód:

---

# For use with easy-rsa version 2.0

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME      = .
RANDFILE    = $ENV::HOME/.rnd
openssl_conf    = openssl_init

[ openssl_init ]
# Extra OBJECT IDENTIFIER info:
#oid_file  = $ENV::HOME/.oid
oid_section  = new_oids
engines                = engine_section

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions    =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

####################################################################
[ ca ]
default_ca  = CA_default    # The default ca section

####################################################################
[ CA_default ]

dir  = $ENV::KEY_DIR  # Where everything is kept
certs  = $dir      # Where the issued certs are kept
crl_dir  = $dir      # Where the issued crl are kept
database  = $dir/index.txt  # database index file.
new_certs_dir = $dir      # default place for new certs.

certificate = $dir/ca.crt  # The CA certificate
serial    = $dir/serial    # The current serial number
crl  = $dir/crl.pem    # The current CRL
private_key = $dir/ca.key  # The private key
RANDFILE  = $dir/.rand    # private random number file

x509_extensions = usr_cert    # The extentions to add to the cert

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crl_extensions  = crl_ext

default_days  = 3650      # how long to certify for
default_crl_days= 30      # how long before next CRL
default_md  = md5    # which md to use.
preserve  = no      # keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy    = policy_anything

# For the CA policy
[ policy_match ]
countryName  = match
stateOrProvinceName = match
organizationName  = match
organizationalUnitName  = optional
commonName    = supplied
name      = optional
emailAddress    = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName  = optional
stateOrProvinceName = optional
localityName    = optional
organizationName  = optional
organizationalUnitName  = optional
commonName    = supplied
name      = optional
emailAddress    = optional

####################################################################
[ req ]
default_bits    = $ENV::KEY_SIZE
default_keyfile  = privkey.pem
distinguished_name  = req_distinguished_name
attributes    = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix  : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
string_mask = nombstr

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName    = Country Name (2 letter code)
countryName_default  = $ENV::KEY_COUNTRY
countryName_min    = 2
countryName_max    = 2

stateOrProvinceName  = State or Province Name (full name)
stateOrProvinceName_default = $ENV::KEY_PROVINCE

localityName      = Locality Name (eg, city)
localityName_default    = $ENV::KEY_CITY

0.organizationName    = Organization Name (eg, company)
0.organizationName_default  = $ENV::KEY_ORG

# we can do this but it is not needed normally :-)
#1.organizationName  = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd

organizationalUnitName    = Organizational Unit Name (eg, section)
#organizationalUnitName_default =

commonName      = Common Name (eg, your name or your server\'s hostname)
commonName_max      = 64

name        = Name
name_max      = 64

emailAddress      = Email Address
emailAddress_default    = $ENV::KEY_EMAIL
emailAddress_max    = 40

# JY -- added for batch mode
organizationalUnitName_default = $ENV::KEY_OU
commonName_default = $ENV::KEY_CN
name_default = $ENV::KEY_NAME

# SET-ex3    = SET extension number 3

[ req_attributes ]
challengePassword  = A challenge password
challengePassword_min  = 4
challengePassword_max  = 20

unstructuredName    = An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType      = server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment    = "Easy-RSA Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=clientAuth
keyUsage = digitalSignature

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl    = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

[ server ]

# JY ADDED -- Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType      = server
nsComment    = "Easy-RSA Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

[ engine_section ]
#
# If you are using PKCS#11
# Install engine_pkcs11 of opensc (www.opensc.org)
# And uncomment the following
# verify that dynamic_path points to the correct location
#
#pkcs11 = pkcs11_section

[ pkcs11_section ]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = $ENV::PKCS11_MODULE_PATH
PIN = $ENV::PKCS11_PIN
init = 0

---

Citace:

---

Původně odeslal admix

Ted jsem si stahnul widli verzi, a tam openssl.cnf je uz z vyroby

Kód:

---

# For use with easy-rsa version 2.0

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME      = .
RANDFILE    = $ENV::HOME/.rnd
openssl_conf    = openssl_init

[ openssl_init ]
# Extra OBJECT IDENTIFIER info:
#oid_file  = $ENV::HOME/.oid
oid_section  = new_oids
engines                = engine_section

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions    =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

####################################################################
[ ca ]
default_ca  = CA_default    # The default ca section

####################################################################
[ CA_default ]

dir  = $ENV::KEY_DIR  # Where everything is kept
certs  = $dir      # Where the issued certs are kept
crl_dir  = $dir      # Where the issued crl are kept
database  = $dir/index.txt  # database index file.
new_certs_dir = $dir      # default place for new certs.

certificate = $dir/ca.crt  # The CA certificate
serial    = $dir/serial    # The current serial number
crl  = $dir/crl.pem    # The current CRL
private_key = $dir/ca.key  # The private key
RANDFILE  = $dir/.rand    # private random number file

x509_extensions = usr_cert    # The extentions to add to the cert

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crl_extensions  = crl_ext

default_days  = 3650      # how long to certify for
default_crl_days= 30      # how long before next CRL
default_md  = md5    # which md to use.
preserve  = no      # keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy    = policy_anything

# For the CA policy
[ policy_match ]
countryName  = match
stateOrProvinceName = match
organizationName  = match
organizationalUnitName  = optional
commonName    = supplied
name      = optional
emailAddress    = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName  = optional
stateOrProvinceName = optional
localityName    = optional
organizationName  = optional
organizationalUnitName  = optional
commonName    = supplied
name      = optional
emailAddress    = optional

####################################################################
[ req ]
default_bits    = $ENV::KEY_SIZE
default_keyfile  = privkey.pem
distinguished_name  = req_distinguished_name
attributes    = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix  : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
string_mask = nombstr

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName    = Country Name (2 letter code)
countryName_default  = $ENV::KEY_COUNTRY
countryName_min    = 2
countryName_max    = 2

stateOrProvinceName  = State or Province Name (full name)
stateOrProvinceName_default = $ENV::KEY_PROVINCE

localityName      = Locality Name (eg, city)
localityName_default    = $ENV::KEY_CITY

0.organizationName    = Organization Name (eg, company)
0.organizationName_default  = $ENV::KEY_ORG

# we can do this but it is not needed normally :-)
#1.organizationName  = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd

organizationalUnitName    = Organizational Unit Name (eg, section)
#organizationalUnitName_default =

commonName      = Common Name (eg, your name or your server\'s hostname)
commonName_max      = 64

name        = Name
name_max      = 64

emailAddress      = Email Address
emailAddress_default    = $ENV::KEY_EMAIL
emailAddress_max    = 40

# JY -- added for batch mode
organizationalUnitName_default = $ENV::KEY_OU
commonName_default = $ENV::KEY_CN
name_default = $ENV::KEY_NAME

# SET-ex3    = SET extension number 3

[ req_attributes ]
challengePassword  = A challenge password
challengePassword_min  = 4
challengePassword_max  = 20

unstructuredName    = An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType      = server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment    = "Easy-RSA Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=clientAuth
keyUsage = digitalSignature

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl    = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

[ server ]

# JY ADDED -- Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType      = server
nsComment    = "Easy-RSA Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

[ engine_section ]
#
# If you are using PKCS#11
# Install engine_pkcs11 of opensc (www.opensc.org)
# And uncomment the following
# verify that dynamic_path points to the correct location
#
#pkcs11 = pkcs11_section

[ pkcs11_section ]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = $ENV::PKCS11_MODULE_PATH
PIN = $ENV::PKCS11_PIN
init = 0

---

---

prima.. :-) dekuji.. hned si ho ulozim :-) treba se mi instal soubor pri stahovani nejak poskodil ci co.. a to jsem to tahal z OpenVPN.net :-)

pokracovat budu odpoledne.. ted mizim na jednani.. zatim dekuji :-)

Nejlepsi mas se podivat primo do toho scriptu co dela, zrovna tenhle jen udela kopii souboru s jinym jmenem.

Jak pise admix, v cerstve nainstalovany verzi (2.2.0) je uz z vyroby, sample naopak chybi.

Tak jsem z5,

pri provedeni clean-all to napise nasledujici:

Systém nemůže nalézt uvedený soubor.
1 zkopírovaných souborů
1 zkopírovaných souborů

dle skriptu a souboru v novem adr. odhaduju ze byl zkopirovan soubor index.txt a soubor serial. do adresáře "keys", ktery byl definovany v souboru vars

vzhledem k odkazovani v souboru vars na openssl.cnf nahradil jsem jeho puvodni obsah za new, ktery jste mi dali zde k dispozici a znova provadl kroky od pocatku.

u tohoto kroku se mi zobrazil nakonec jen misto puvodnich 3 radku jen posledni 2

je to takto spravne?.. jak to ze pred zamenou mi to napsalo ten prvni radek? jak to ze pomohla nahrada obsahu openssl.cnf i pres to ze pouzivam taktez verzi 2.2.0 ze ktere jste mi zde vypsali soubor?

thx za answer :-)

A co v tom openssl.cnf bylo puvodne? clean-all pokud se nepletu maze vse, vcetne klicu, takze to pak uz nepoustet. Zaloguj si nekam obsah terminalu, at vidime co vlastne delas :)

co delam?.. jedu presne dle http://openvpn.net/index.php/open-so...ion/howto.html jak mi zde napsali ze to dle toho jde.. tak to zkousim :-)

strucne zpetne receno.. pres komandy cmd si najedu do adr "easy-rsa" kde jsou jednotlive bat soubory, ktere pri vytvareni CA spoustim v urcenem poradi

krok 1
init-config //vse OK
krok 2
vars //ok
clean-all //problem vyresen
build-ca //mam problem

WARNING: can't open config file: c:\openssl/ssl/openssl.cnf
error on line 149 of openssl.cnf
3400:error:0E065068:configuration file routines:STR_COPY:variable has no value:.\crypto\conf\conf_def.c:618:line 149

"hlaseni jsem opsal do detajlu jak mi to vypsalo"

zhlaseni chapu ze nemuze otevrit dane umisteni souboru.. jeste aby ne.. kdyz je jinde.. na radku 149 jsem byl (dal jsem si tu praci a pocital jsem do 149) ale nastaveni cesty pro openssl.cnf jsem nenasel.

co mi poradis ?

Dost mozna mi v tom openssl.cnf neco vypadlo, to melo bejt spis pro inspiraci nez pro copypasta navod ... stahni si ho znova a koukni, co v nem je, a uprav pripadne cesty dle potreby.

Citace:

---

Původně odeslal admix

Dost mozna mi v tom openssl.cnf neco vypadlo, to melo bejt spis pro inspiraci nez pro copypasta navod ... stahni si ho znova a koukni, co v nem je, a uprav pripadne cesty dle potreby.

---

tuto moznost jsem jiz taktez udelal.. samozdrejme pres vlozenim tveho obsahu jsem si vytvoril zalohu.. a pred psanim textu jsem nejprve vyzkousel stejnou cast se zalohovanym souborem...

opravdu to budem cele resit zde takto po vzkazikach ?.. problem mi to nedela..jen to trochu casove natahuje celkovou komunikaci :-)

tak jsem upravil obsah openssl.cnf dle web str http://fusesource.com/docs/framework...y/i280763.html

a tim jsem presel vyskytlou chybu ktera se mi jiz nezobrazila

sice mi pri prikazu build-ca napsalo opet varovani ze nemuze zapisovat do souboru openssl.cnf ale prikaz pokracoval dale bez dalsich erroru skoro az na konec "dotazniku" kde mi to napsalo:

Error opening CA private key /opt/iona/OrbixSSL1.0c/certs/CA/OrbixCA.pk
424:error:02001003:system library:fopen:No such process:.\crypto\bio\bss_file.c:398:fopen('/opt/iona/OrbixSSL1.0c/certs/CA/OrbixCA.pk','rb')
424:error:20047002:BIO routines:FILE_CTRL:system bil:.\crypto\bio\bss_file.c:400:unable to load CA private key

tak z tohoto hlaseni nejsem vubec moudr.. co to znamena ?

Proste tomu chybi nekde nejakej soubor, podle te cesty hadam, ze je to nejaky default fallback, tudiz jsi nekde zapomnel neco nadefinovat?

Citace:

---

Původně odeslal admix

Proste tomu chybi nekde nejakej soubor, podle te cesty hadam, ze je to nejaky default fallback, tudiz jsi nekde zapomnel neco nadefinovat?

---

thx.. to je hodne urcita odpoved co mi rika ico s tim mam delat... :-)

Sorry, ale neposkytujes temer zadne informace, takze budto budes muset hodne hledat, nebo sem hodne vkladat informace ;)