Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a VPN over a few VMS that I have. I created an openvpn server on ubuntu 10.04 and am trying to configure the client using 12.04. I followed these instructions here, except for some changes to the config files. When I run openvpn --config client.conf on the client, I get this.

Sat Apr 14 15:11:26 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Sat Apr 14 15:11:26 2012 WARNING: No server certificate verification method has been enabled.  See for more info.
Sat Apr 14 15:11:26 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Apr 14 15:11:26 2012 Cannot load private key file /home/fpayer/keys/cerberus.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
Sat Apr 14 15:11:26 2012 Error: private key password verification failed
Sat Apr 14 15:11:26 2012 Exiting

I have verified that the file exists, and it looks fine to me although I do not know much about ssl. It seems to me like it is looking for a .pem, but the instructions never said to generate one. I also find it strange that I can connect thru network manager, but cannot ping the server, maybe it's a problem with network manager. What should I do to get the client working?

Here are my config files:


port 1194
proto udp
dev tun0

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpn-server.crt
key /etc/openvpn/easy-rsa/keys/vpn-server.key
dh /etc/openvpn/dh1024.pem 

ifconfig-pool-persist openvpn.dhcp

keepalive 10 120

user nobody
group nogroup

status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 4
mute 20

;push "route"
;push "route"
;push "redirect-gateway def1"

;client-config-dir ccd
; max-clients 10


dev tun0
proto udp
remote 1194
resolv-retry infinite

user nobody
group nogroup


ca /home/fpayer/keys/ca.crt
cert /home/fpayer/keys/cerberus.crt
key /home/fpayer/keys/cerberus.crt
tls-auth /home/fpayer/keys/ta.key 1

verb 3

If you could find any problems in either config file or fixing the key verification, it would be greatly appreciated.

Server IP : Client IP:

share|improve this question

It seems like your cerberus.crt is corrupted. How did you transfer the files to your client machine? Are you sure your keys are correct? Have you used some other operative system for the transfer or have you edited the file, something that could have changed the way it was originally generated? Did you use:

./pkitool cerberus

to generate the keys?
I have connected succesfully these configurations:

Client 11.10 (keys generated from a 10.04 server) -> server 12.04 (upgraded from 10.04, same key set as of 10.04 era).
Client 12.04 -> server 12.04 (both, client and server keys generated on a 10.04 server)
The only thing different between your conf files and mine, is that I don't have this line

tls-auth /home/fpayer/keys/ta.key 1

neither on server nor client

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.