We have a few OpenVPN servers where our self-signed root ca which was valid for 10 years is running out. Therefore, we want to update to a new root ca certificate. Since we have hundreds of clients and we want to do this with minimal downtime, we need a way so that for a brief period, the OpenVPN server accepts both new and old certificates. We found this guide and followed the second (improved) process, but probably did something wrong:
- We created a new self signed root ca.
- We created a new server certificate signed by the new root ca.
- We created a new client cert and verified we can connect.
- We add the new ca cert and the old ca cert to a single file (cert stacking). The new client can still connect.
- We tried creating the intermediate server certificate by generating a certificate sign request giving the new root ca private key as --key, then signed this CSR with the old root ca. Did we understand this step right? Using the new root ca private key as the server cert private key seems weird.
- We add both new and intermediate server cert into a single file by appending one to the other, and start the openvpn process with the combined ca certs, the combined server certs, and the new server key.
The new client can still connect, but the old client complains about a "authority and subject key identifier mismatch". Here are the certs which I created for this test:
Old CA certificate:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domail/emailAddress=info@some.domain
Validity
Not Before: Apr 9 09:12:40 2021 GMT
Not After : Apr 7 09:12:40 2031 GMT
Subject: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeOtherUnit, CN=some.domain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:b0:97:a8:05:17:0f:6d:04:92:ea:b6:06:f4:fc:
10:18:90:72:88:ff:03:f5:98:12:2d:86:66:6b:e6:
e4:df:b4:f2:e8:e5:e9:66:ce:0f:5c:ab:a2:6b:a5:
08:77:6d:bb:f1:41:79:2e:1f:38:84:7c:c9:93:fb:
dd:5e:f8:5b:fc:13:11:a4:29:ae:8c:da:ce:c8:94:
74:ce:ce:ca:68:ac:41:1a:49:e6:0b:1c:bb:e3:63:
8e:71:8c:4a:8f:bb:ad:33:bd:7d:21:2d:8b:9f:c5:
d9:ae:52:50:d6:da:39:02:53:29:53:31:91:a7:99:
f9:d8:c5:f1:8e:82:b2:d0:eb
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
31:FA:C8:F9:F8:63:69:CB:C7:6B:A5:40:8E:9C:E9:65:79:C4:71:B1
X509v3 Authority Key Identifier:
keyid:77:83:B0:60:43:9B:4F:E8:73:19:15:03:84:51:1C:62:01:9E:B2:61
DirName:/C=XX/ST=XXX/L=XXXX/O=XXX Inc/OU=SomeUnit/CN=some.domain/emailAddress=info@some.domain
serial:EE:85:9E:95:CC:AB:12:44
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:2
X509v3 Key Usage:
Certificate Sign, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
32:2d:56:af:f0:25:4e:dd:b9:46:32:93:b3:b4:e1:0f:d1:e2:
64:23:34:e1:76:3a:68:1d:52:a0:d2:29:28:a6:81:d1:e2:8d:
98:b5:3c:03:df:64:c5:54:2a:0a:a6:3c:26:bd:c4:cc:ef:fd:
4a:79:70:b4:ac:b8:a8:6f:a9:34:90:3e:27:0a:5b:b0:b6:ca:
b7:3d:c7:99:03:d4:14:bb:68:81:1e:31:4c:ab:48:f8:b8:14:
41:15:1a:ef:3a:58:8f:08:58:b7:95:33:cd:ed:de:93:f2:46:
74:9e:92:70:fe:2c:bc:1d:80:1c:54:76:2a:45:7f:09:e6:bd:
42:32
New CA certificate:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
98:67:8c:a0:53:b0:e3:cf
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domain/emailAddress=info@some.domain
Validity
Not Before: Aug 31 11:39:22 2022 GMT
Not After : Aug 25 11:39:22 2047 GMT
Subject: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domain/emailAddress=info@some.domain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:e9:6e:a9:eb:03:fe:12:b2:7f:68:6d:8a:24:1a:
44:50:5d:21:71:65:d2:f5:0a:17:18:cf:8f:b5:df:
79:b8:d7:8e:d2:d3:bf:8c:a8:fd:21:7b:c4:39:a8:
3d:98:08:3c:eb:1e:de:92:0a:1f:4a:6c:b3:fd:28:
43:46:03:a7:56:76:6e:00:e0:a5:81:a8:fe:91:7a:
4a:27:c3:ba:58:1d:91:d1:3b:d0:56:73:6f:de:a2:
60:b9:71:3f:a0:d3:70:7e:d0:b4:67:0a:f3:f2:80:
cb:f9:3f:3e:6a:5c:7e:c1:63:dc:8b:22:4f:2e:87:
1b:ee:49:e0:62:58:f1:b3:45
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
26:E9:93:D7:DF:76:1B:91:2C:86:F8:FE:3F:5B:AF:04:70:21:A6:FC
X509v3 Authority Key Identifier:
keyid:26:E9:93:D7:DF:76:1B:91:2C:86:F8:FE:3F:5B:AF:04:70:21:A6:FC
DirName:/C=XX/ST=XXX/L=XXXX/O=XXX Inc/OU=SomeUnit/CN=some.domain/emailAddress=info@some.domain
serial:98:67:8C:A0:53:B0:E3:CF
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:2
X509v3 Key Usage:
Certificate Sign, CRL Sign
Signature Algorithm: sha1WithRSAEncryption
cc:95:fb:44:42:5a:fb:43:ea:c0:dc:98:6e:cc:69:e0:c6:6f:
b1:f2:7b:c1:5e:5c:27:37:01:00:4e:24:9b:9e:21:30:33:c9:
df:97:26:ae:6a:60:d5:80:d5:3e:a0:e6:6e:9a:fc:9c:81:ff:
e0:51:dd:cf:67:4f:af:9f:12:87:02:bf:52:f6:bb:9e:7c:69:
c8:11:10:a1:27:14:c3:bc:17:72:8f:d1:fe:42:02:d3:9d:a3:
14:ba:18:85:3d:4b:9d:a2:12:c0:fe:91:b6:65:72:e5:e1:7b:
d3:ca:7f:06:f4:b5:19:5e:79:97:59:ed:52:eb:b1:0a:50:6d:
61:8b
New server certificate:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domain/emailAddress=info@some.domain
Validity
Not Before: Aug 31 11:39:24 2022 GMT
Not After : Aug 25 11:39:24 2047 GMT
Subject: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domain/emailAddress=info@some.domain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:dc:64:dc:eb:80:de:eb:dd:81:ce:9c:6b:7d:3d:
72:d9:fc:ef:bd:79:4b:c1:8a:be:39:49:49:e1:7a:
d7:21:b2:f7:9a:b6:16:80:67:75:c2:63:60:8a:5c:
7f:7c:d3:55:f5:15:6a:bb:f9:bc:bb:30:20:4b:21:
a6:4a:59:b8:41:59:c4:3d:af:07:e6:75:12:61:04:
7b:1e:03:a1:31:dc:45:91:78:b2:cf:de:d4:8a:c5:
e0:32:5c:90:69:68:35:8e:5f:5f:c6:d3:fb:d2:60:
d1:30:78:22:ec:54:ac:46:91:f1:89:1c:a4:0b:28:
5a:23:d2:ab:c0:f3:3d:9a:bd
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
07:01:F3:91:F1:D8:F2:72:93:56:54:F6:86:61:60:71:8C:3E:6F:67
X509v3 Authority Key Identifier:
keyid:26:E9:93:D7:DF:76:1B:91:2C:86:F8:FE:3F:5B:AF:04:70:21:A6:FC
X509v3 Key Usage:
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
Netscape Cert Type:
SSL Server
X509v3 Subject Alternative Name:
IP Address:192.168.0.1
Signature Algorithm: sha1WithRSAEncryption
8d:36:9e:22:d3:0a:68:63:ef:33:8d:ad:85:64:be:81:d4:96:
0b:5f:28:ab:07:cf:af:6b:9a:14:ff:70:d9:e1:78:f2:53:8d:
19:6c:1b:5c:77:2f:91:97:76:c5:3d:ef:b6:5f:b0:12:0c:79:
32:c7:5b:d6:c8:bb:2b:b0:21:e0:50:35:b3:73:2e:2f:c4:d2:
91:72:8a:3e:66:1f:b4:42:70:ae:fe:08:23:16:5d:3c:fe:1d:
9f:25:fa:0f:01:43:c7:c7:f9:12:cd:6a:5e:49:33:f1:42:5d:
bd:34:77:1c:fe:54:66:20:69:7a:58:1d:09:d2:d0:c1:53:9e:
7c:b4
Intermediate server cert with new root ca private key but csr signed with old ca:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeOtherUnit, CN=some.domain
Validity
Not Before: Aug 31 11:39:35 2022 GMT
Not After : Aug 25 11:39:35 2047 GMT
Subject: C=XX, ST=XXX, L=XXXX, O=XXX Inc, OU=SomeUnit, CN=some.domain2/emailAddress=info@some.domain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:e9:6e:a9:eb:03:fe:12:b2:7f:68:6d:8a:24:1a:
44:50:5d:21:71:65:d2:f5:0a:17:18:cf:8f:b5:df:
79:b8:d7:8e:d2:d3:bf:8c:a8:fd:21:7b:c4:39:a8:
3d:98:08:3c:eb:1e:de:92:0a:1f:4a:6c:b3:fd:28:
43:46:03:a7:56:76:6e:00:e0:a5:81:a8:fe:91:7a:
4a:27:c3:ba:58:1d:91:d1:3b:d0:56:73:6f:de:a2:
60:b9:71:3f:a0:d3:70:7e:d0:b4:67:0a:f3:f2:80:
cb:f9:3f:3e:6a:5c:7e:c1:63:dc:8b:22:4f:2e:87:
1b:ee:49:e0:62:58:f1:b3:45
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
26:E9:93:D7:DF:76:1B:91:2C:86:F8:FE:3F:5B:AF:04:70:21:A6:FC
X509v3 Authority Key Identifier:
keyid:31:FA:C8:F9:F8:63:69:CB:C7:6B:A5:40:8E:9C:E9:65:79:C4:71:B1
X509v3 Key Usage:
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
Netscape Cert Type:
SSL Server
X509v3 Subject Alternative Name:
IP Address:192.168.0.1
Signature Algorithm: sha1WithRSAEncryption
47:7a:f0:8c:bb:06:ec:32:17:ee:a9:7d:9d:76:6f:91:b8:c6:
f6:e8:dc:bc:50:de:1e:47:ff:e2:9a:99:82:e6:2b:79:2f:c9:
63:0d:f5:1c:24:63:47:e3:85:b0:23:c1:a8:57:24:5a:96:ca:
4c:88:18:e6:72:ae:36:01:3d:b2:b9:64:d4:83:2a:29:17:54:
45:d4:2f:bc:56:00:ed:e9:8f:cd:8b:b7:78:83:5d:9b:97:29:
97:8c:a1:ca:09:8e:89:d5:02:b5:b7:4c:38:5a:a7:33:7f:39:
25:ed:9e:bc:1d:57:6d:7b:4d:ba:3b:d9:74:b6:cd:8f:52:27:
7f:07
