Help Center/ Virtual Private Network/ Troubleshooting/ Client Connection Failures/ The Client Log Contains "error=path length constraint exceeded"
Updated on 2025-05-14 GMT+08:00
View PDF
Share

The Client Log Contains "error=path length constraint exceeded"

Applicable Client

Windows OpenVPN GUI

Symptom

A client cannot connect to a P2C VPN gateway, and the log contains the following error information:

error=path length constraint exceeded

Possible Causes

The length of the CA certificate chain in the client configuration exceeds 3.

Procedure

  1. Re-generate CA certificates. For details, see Using Easy-RSA to Issue Certificates (Server and Client Sharing a CA Certificate).
  1. Log in to the management console.
  2. Click in the upper left corner and select the desired region and project.
  3. Click in the upper left corner, and choose Networking > Virtual Private Network.
  4. In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Gateways.
  5. Click the P2C VPN Gateways tab. In the P2C VPN gateway list, locate the target P2C VPN gateway, and click View Server in the Operation column.
  6. Upload CA certificates.
    1. On the Server tab page, choose Certificate authentication from the Client Authentication Mode drop-down list box, and click Upload CA Certificate.
    2. Set parameters as prompted.
      Table 1 Parameters for uploading a CA certificate

      Parameter

      Description

      Example Value

      Name

      This parameter can be modified.

      ca-cert-xxxx

      Content

      Use a text editor (for example, Notepad++) to open the signature certificate file in PEM format, and copy the certificate content to this text box.

      NOTE:
      • It is recommended to use a certificate with a strong cryptographic algorithm, such as RSA-3072 or RSA-4096.
      • Certificates using the RSA-2048 encryption algorithm have risks. Exercise caution when using such certificates.

      -----BEGIN CERTIFICATE-----

      Certificate content

      -----END CERTIFICATE-----
    3. Click OK.
  7. Delete the incorrect CA certificate.
    1. On the Server tab page, click Delete in the Operation column of the incorrect client CA certificate.
    2. In the Delete CA Certificate dialog box, click OK.
  8. Download the new client configuration file.

    The downloaded client configuration file is client_config.zip.

  9. Decompress client_config.zip to a specified directory, for example, D:\.

    After the decompression, the client_config.ovpn and client_config.conf files are generated.

  10. Open the client_config.ovpn file using Notepad or Notepad++.
  11. Add the client certificate and private key to the file.
    Enter the client certificate content and the corresponding private key in between <cert></cert> and <key></key> tags, respectively. An example is as follows: 
    <cert>
-----BEGIN CERTIFICATE-----
Client certificate content
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
Client private key
-----END PRIVATE KEY-----
</key>
  12. Save the .ovpn configuration file.
  13. Start the OpenVPN client.
  14. Import the new client configuration file.
  15. Use the client to reconnect to the VPN gateway.
  16. Press Win+R and enter cmd to open the command window.

  17. XX.XX.XX.XX indicates the private IP address of the ECS to be connected. Replace it with the actual private IP address.

    If information similar to the following is displayed, the client can communicate with the ECS:

    64 bytes from XX.XX.XX.XX: icmp_seq=1 ttl=63 time=1.27 ms
64 bytes from XX.XX.XX.XX: icmp_seq=2 ttl=63 time=1.36 ms
64 bytes from XX.XX.XX.XX: icmp_seq=3 ttl=63 time=1.40 ms
64 bytes from XX.XX.XX.XX: icmp_seq=4 ttl=63 time=1.29 ms
64 bytes from XX.XX.XX.XX: icmp_seq=5 ttl=63 time=1.35 ms
64 bytes from XX.XX.XX.XX: icmp_seq=6 ttl=63 time=1.52 ms

If the problem persists, submit a service ticket to contact Huawei technical support.