Certificate error log

2 posts / 0 new
Last post
nekton23
nekton23's picture
Certificate error log

I just set up a WNR3500LV2 with tomato firmware 1.28 and all the basic functions seem to be working fine but when I try to complete the VPN tunnelling I am getting a certificate authority error in the logs.  The WNR connects by LAN port to an existing LAN and has a static IP in the same address and subnet mask as all other devices on the LAN.  There is no DHCP anywhere; I followed the most recent PIA document at tomato (https://www.privateinternetaccess.com/forum/discussion/110/updated-tomat...for setting up VPN tunneling on this router with tomato firmware and it all went as planned and all the settings seem correct—I have triple checked. I also checked the VPN account is working direct from a Mac with the router settings and it seems fine. 

But when I clock Start Now: this is the log that comes back.

 

Has anyone got an idea what I am doing wrong>


Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: asynchronous logging enabled, queue limit is 5 messages

Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: reading /etc/resolv.dnsmasq
Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: using nameserver 8.8.8.8#53
Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: using nameserver 8.8.4.4#53
Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: read /etc/hosts - 2 addresses
Jun 11 22:30:04 unknown daemon.info dnsmasq[3833]: read /etc/dnsmasq/hosts/hosts - 3 addresses
Jun 11 22:30:04 unknown user.debug init[1]: starting rstats.
Jun 11 22:30:05 unknown user.info init[1]: Netgear WNR3500L v2: Tomato 1.28.0505 MIPSR2Toastman-RT-N K26 USB VLAN-VPN
Jun 11 22:32:21 unknown daemon.notice openvpn[3956]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 11 22:32:21 unknown daemon.warn openvpn[3956]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 11 22:32:21 unknown daemon.warn openvpn[3956]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 11 22:32:21 unknown daemon.err openvpn[3956]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 11 22:32:21 unknown daemon.notice openvpn[3956]: Exiting due to fatal error
Jun 11 22:40:04 unknown daemon.notice openvpn[3983]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 11 22:40:04 unknown daemon.warn openvpn[3983]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 11 22:40:04 unknown daemon.warn openvpn[3983]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 11 22:40:04 unknown daemon.err openvpn[3983]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 11 22:40:04 unknown daemon.notice openvpn[3983]: Exiting due to fatal error
Jun 11 22:40:19 unknown daemon.notice openvpn[3994]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 11 22:40:19 unknown daemon.warn openvpn[3994]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 11 22:40:19 unknown daemon.warn openvpn[3994]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 11 22:40:19 unknown daemon.err openvpn[3994]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 11 22:40:19 unknown daemon.notice openvpn[3994]: Exiting due to fatal error
Jun 11 22:46:09 unknown daemon.notice openvpn[4094]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 11 22:46:09 unknown daemon.warn openvpn[4094]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 11 22:46:09 unknown daemon.warn openvpn[4094]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 11 22:46:09 unknown daemon.err openvpn[4094]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 11 22:46:09 unknown daemon.notice openvpn[4094]: Exiting due to fatal error
Jun 11 22:48:36 unknown syslog.info syslogd exiting
Jun 11 22:48:36 unknown syslog.info syslogd started: BusyBox v1.21.1
Jun 11 22:48:36 unknown user.notice kernel: klogd started: BusyBox v1.21.1 (2014-04-21 18:34:04 ICT)
Jun 11 22:56:47 unknown daemon.notice openvpn[4222]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 11 22:56:47 unknown daemon.warn openvpn[4222]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 11 22:56:47 unknown daemon.warn openvpn[4222]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 11 22:56:47 unknown daemon.err openvpn[4222]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 11 22:56:47 unknown daemon.notice openvpn[4222]: Exiting due to fatal error
Jun 11 23:00:01 unknown syslog.info root: -- MARK --
Jun 12 00:00:01 unknown syslog.info root: -- MARK --
Jun 12 00:44:38 unknown daemon.notice openvpn[4294]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 21 2014
Jun 12 00:44:38 unknown daemon.warn openvpn[4294]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 12 00:44:38 unknown daemon.warn openvpn[4294]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 12 00:44:38 unknown daemon.err openvpn[4294]: Cannot load CA certificate file ca.crt (OpenSSL)
Jun 12 00:44:38 unknown daemon.notice openvpn[4294]: Exiting due to fatal error
Jun 12 01:00:01 unknown syslog.info root: -- MARK --

 

nekton23
nekton23's picture
To eat my own dogfood, the

To eat my own dogfood, the problem was that I copied and pasted everything BETWEEN the beginning and end of certificate lines when those lines should have been included!

Why the hell that is not mentioned in the various how tos at the PIA site is beyond my common sense understanding.