The Client Log Contains "certReadError"

Applicable Client

• Linux
• Windows OpenVPN GUI

Symptom

A client cannot connect to a P2C VPN gateway, and the log contains the following error information:

certReadError

Possible Causes

In certificate authentication mode, the client configuration file does not contain the client certificate or private key.

Procedure

1. Re-generate a client certificate and private key. For details, see Using Easy-RSA to Issue Certificates (Server and Client Sharing a CA Certificate). In this example, the generated client certificate and private key are p2cclient.com.crt and p2cclient.com.key, respectively.
2. Open the p2cclient.com.crt, p2cclient.com.key, and client_config.ovpn files using Notepad or Notepad++.
3. Copy the generated client certificate and private key to the client configuration file.
   Enter the client certificate content and the corresponding private key in between <cert></cert> and <key></key> tags, respectively. An example is as follows:

   <cert>
   -----BEGIN CERTIFICATE-----
   Client certificate content
   -----END CERTIFICATE-----
   </cert>
   
   <key>
   -----BEGIN PRIVATE KEY-----
   Client private key
   -----END PRIVATE KEY-----
   </key>

4. Save the .ovpn configuration file.
5. Start the OpenVPN client.
6. Import the new client configuration file.
7. Use the client to reconnect to the VPN gateway.
8. On Windows, press Win+R and enter cmd to open the command window.

   On Linux, log in as the root user and open the command window.

9. 

   XX.XX.XX.XX indicates the private IP address of the ECS to be connected. Replace it with the actual private IP address.

   If information similar to the following is displayed, the client can communicate with the ECS:

   64 bytes from XX.XX.XX.XX: icmp_seq=1 ttl=63 time=1.27 ms
   64 bytes from XX.XX.XX.XX: icmp_seq=2 ttl=63 time=1.36 ms
   64 bytes from XX.XX.XX.XX: icmp_seq=3 ttl=63 time=1.40 ms
   64 bytes from XX.XX.XX.XX: icmp_seq=4 ttl=63 time=1.29 ms
   64 bytes from XX.XX.XX.XX: icmp_seq=5 ttl=63 time=1.35 ms
   64 bytes from XX.XX.XX.XX: icmp_seq=6 ttl=63 time=1.52 ms

If you use a client on Linux, you need to upload the configuration file client_config.conf to the Linux system using Xftp. For details, see Configuring a Client.