ANSWERED OpenVPN Certificate has expired

[Philiberti 9]

Eddie won't connect and it's showing an error message that the OpenVPN certifificate has expired. Can anyone help?

Edited ... by Staff
Subject typo fix to improve search

[Absydion 0]

This is also happening to me ... trying to connect to Canadian severs. Every one fails with the error "OpenVPN > Warning: Your certificate has expired!"

[2mD 1]

I have the same problem. Part of the log file:

I 2024.04.07 18:01:05 - Session starting.
I 2024.04.07 18:01:06 - Checking authorization ...
. 2024.04.07 18:01:06 - Added new network interface "Eddie", Wintun version 0.12
. 2024.04.07 18:01:06 - Using WinTun network interface "Eddie (Wintun Userspace Tunnel)"
! 2024.04.07 18:01:06 - Connecting to Dalim (Netherlands, Alblasserdam)
. 2024.04.07 18:01:06 - Routes, add 134.19.179.213/32 for interface "Ethernet (Realtek Gaming 2.5GbE Family Controller)".
. 2024.04.07 18:01:06 - Routes, add 134.19.179.213/32 for interface "Ethernet (Realtek Gaming 2.5GbE Family Controller)", already exists.
. 2024.04.07 18:01:06 - OpenVPN > OpenVPN 2.5.5 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 15 2021
. 2024.04.07 18:01:06 - OpenVPN > Windows version 10.0 (Windows 10 or greater) 64bit
. 2024.04.07 18:01:06 - OpenVPN > library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
W 2024.04.07 18:01:06 - OpenVPN > WARNING: Your certificate has expired!
. 2024.04.07 18:01:06 - OpenVPN > Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
. 2024.04.07 18:01:06 - OpenVPN > Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
. 2024.04.07 18:01:06 - OpenVPN > Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
. 2024.04.07 18:01:06 - OpenVPN > Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
. 2024.04.07 18:01:06 - OpenVPN > TCP/UDP: Preserving recently used remote address: [AF_INET]134.19.179.213:443
. 2024.04.07 18:01:06 - OpenVPN > Socket Buffers: R=[65536->262144] S=[65536->262144]
. 2024.04.07 18:01:06 - OpenVPN > UDP link local: (not bound)
. 2024.04.07 18:01:06 - OpenVPN > UDP link remote: [AF_INET]134.19.179.213:443
. 2024.04.07 18:01:06 - OpenVPN > TLS: Initial packet from [AF_INET]134.19.179.213:443, sid=4e6601e2 547af0d7
. 2024.04.07 18:01:06 - OpenVPN > VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
. 2024.04.07 18:01:06 - OpenVPN > VERIFY KU OK
. 2024.04.07 18:01:06 - OpenVPN > Validating certificate extended key usage
. 2024.04.07 18:01:06 - OpenVPN > ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
. 2024.04.07 18:01:06 - OpenVPN > VERIFY EKU OK
. 2024.04.07 18:01:06 - OpenVPN > VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=Dalim, emailAddress=info@airvpn.org
! 2024.04.07 18:01:25 - Disconnecting
. 2024.04.07 18:01:25 - Sending soft termination signal
. 2024.04.07 18:01:28 - OpenVPN > SIGTERM received, sending exit notification to peer
. 2024.04.07 18:01:30 - OpenVPN > SIGTERM[soft,exit-with-notification] received, process exiting
. 2024.04.07 18:01:30 - Routes, delete 134.19.179.213/32 for interface "Ethernet (Realtek Gaming 2.5GbE Family Controller)".
. 2024.04.07 18:01:30 - Routes, delete 134.19.179.213/32 for interface "Ethernet (Realtek Gaming 2.5GbE Family Controller)", not exists.
. 2024.04.07 18:01:30 - Connection terminated.
I 2024.04.07 18:01:30 - Cancel requested.
! 2024.04.07 18:01:30 - Session terminated.
! 2024.04.07 18:02:14 - Deactivation of Network Lock

anyone else ?
and does anyone know what to do ?
 

[j2ru 0]

I'm also having the same problem.

OpenVPN > WARNING: Your certificate has expired!

[Staff 9972]

Hello!

The problem affects those users who run Eddie Desktop edition with OpenVPN and never logged out for more than a year, or use OpenVPN clients with configuration files generated before 2021. Since Eddie Desktop edition re-downloads certificates and keys only when the operator logs in, locally some certificates have expired because we extend their expiration date automatically at least one year in advance (three years normally).

Please try the following procedure to quickly resolve the problem:

• run Eddie
• on Eddie's main window uncheck "Remember me"
• log your account out
• log your account in (you'll need to re-enter your AirVPN credentials)
• try again a connection

Kind regards
 

[2mD 1]

Thanks, renewing the key in the "client area / manage VPN devices" worked

[MortenM 3]

Same problem here. Suddenly today. Downloaded latest version and installed just in case. There must be something wrong other than here locally? The suggested fix is way too complicated... That was lazy.. pointing to a description of ten thousand words to do something that probably is easy... Please give a step by step way to fix this without a million other things mixed in.

[boratsandhu 1]

Looks like a lot of people are having the same issue today! The fix suggested above (renew, log out, log in) worked. Thanks!

[sgee34 0]

I have downloaded the latest client, logged out  and selected my new profile. I am no longer getting the certificate security, but Eddie is just stuck in a connect/disconnect loop. Says auth failed 1,2, 3 then it starts all over again.

[go558a83nk 362]

pfsense warned me last month that some old certs were expiring so I'm not surprised that some people are seeing this results.  It's unfortunate that software (eddie) or this web site didn't warn people they were using certs about to expire.

[Craig Buchanan 0]

I had the same "OpenVPN certificate is expired" problem.
I found these instructions and renewed my device certificate.
(Tried this twice.)
Now when I try to connect it instantly disconnects and fails over, instantly disconnects and fails over, ...
That didn't seem to help. What now? Thanks

[rod521 1]

Thanks, renewing the key in the "client area / manage VPN devices" worked for me, too.

[Novak1571 7]

1 hour ago, MortenM said:

Same problem here. Suddenly today. Downloaded latest version and installed just in case. There must be something wrong other than here locally? The suggested fix is way too complicated... That was lazy.. pointing to a description of ten thousand words to do something that probably is easy... Please give a step by step way to fix this without a million other things mixed in.

I agree with your sentiment - it takes a lot of time when you're unfamiliar with this stuff and are already busy doing something else. But it is easier than it seems. To renew the certificate:

- Go to https://airvpn.org/
- Sign in
- Select the "Client Area" tab
- Under "VPN Devices" click the "Manage" button
- Click the "Details" button
- Click the "Renew" button

Then do what Staff says in the above post:

- run Eddie
- on Eddie's main window uncheck "Remember me"
- log your account out
- log your account in (you'll need to re-enter your AirVPN credentials)
- try again a connection

 

[iamgjc 1]

++  Thank you.

[Wyvifory 1]

Quote

on Eddie's main window uncheck "Remember me"

Actually this step was unnecessary for me. Simply clicking logout and login worked. Edited ... by Wyvifory

[MortenM 3]

10 hours ago, Novak1571 said:

I agree with your sentiment - it takes a lot of time when you're unfamiliar with this stuff and are already busy doing something else. But it is easier than it seems. To renew the certificate:

- Go to https://airvpn.org/
- Sign in
- Select the "Client Area" tab
- Under "VPN Devices" click the "Manage" button
- Click the "Details" button
- Click the "Renew" button

Then do what Staff says in the above post:

- run Eddie
- on Eddie's main window uncheck "Remember me"
- log your account out
- log your account in (you'll need to re-enter your AirVPN credentials)
- try again a connection

 

THANK YOU!!!!  You just did what airvpn should have done! Applause to You!

[Staff 9972]

12 hours ago, sgee34 said:

I have downloaded the latest client, logged out  and selected my new profile. I am no longer getting the certificate security, but Eddie is just stuck in a connect/disconnect loop. Says auth failed 1,2, 3 then it starts all over again.

 

11 hours ago, Craig Buchanan said:

Now when I try to connect it instantly disconnects and fails over, instantly disconnects and fails over, ...
That didn't seem to help. What now? Thanks

Hello!

Please uncheck (on Eddie's main window) "Remember me", log your account out, then log your account in. If the problem persists open a ticket and send a system report:
https://airvpn.org/forums/topic/50663-youve-been-asked-for-a-support-filesystem-report-–-heres-what-to-do/

Kind regards
 

[Philiberti 9]

Thanks to all staff and members for your quick response - Eddie is now up and running as before. I found that once you log out and go to log in again it's best to delete and re-enter your username and password to log in.

Thanks again everyone

[Staff 9972]

22 hours ago, go558a83nk said:

pfsense warned me last month that some old certs were expiring so I'm not surprised that some people are seeing this results.  It's unfortunate that software (eddie) or this web site didn't warn people they were using certs about to expire.

Hello!

The client certificates expiration dates were extended well in advance, a year ago (there is no certificate expiring in 2024), so no warning in the web site was indeed due. ca.crt expiring in 2024 was extended in 2021 (this time we went for 100 years, up to 2121). Here the problem is that Eddie Desktop edition re-downloads the certificates only when the user logs in, so the issue in this thread is caused by expired local certificates. The problem therefore affects those users with Eddie Desktop edition who created their account before 2015 and never logged out in the last thirteen months (indeed best customers!), and use OpenVPN and not WireGuard, or those users who never re-downloaded the ca.crt ever since 2021.

If your pfSense system warned you of imminent certificate expiration, then most probably you are (were) using the client certificate downloaded before the automated expiration date extension: just re-download and check whether the problem gets sorted out.

Surely and definitely we can add in Eddie Desktop edition a forced re-download, similarly to what Eddie Android and Bluetit do, which happens even when the user never logs out, but we can't do it for third party software, of course.

Kind regards
 

[Staff 9972]

14 hours ago, MortenM said:

Same problem here. Suddenly today. Downloaded latest version and installed just in case. There must be something wrong other than here locally? The suggested fix is way too complicated... That was lazy.. pointing to a description of ten thousand words to do something that probably is easy... Please give a step by step way to fix this without a million other things mixed in.

Hello!

In reality, the first point was superfluous, but it's always useful, if not mandatory, to read the manuals, especially when using services with sensitive aims (in this case enhancing privacy and providing a decent layer of anonymity).

Contrary to what some tech giants would have you believe, and although illiteracy is on the rise even in "Western countries", many of the "average consumers" (horrible definition) are still able to concentrate for 3-4 minutes, read and understand manuals and guides. Luckily your idiosyncrasy against 2 minutes reading of important documents is very uncommon in AirVPN users and customers.

Kind regards
 

[swampmonster 1]

20 hours ago, Staff said:

Hello!

The problem affects those users who run Eddie Desktop edition with OpenVPN and never logged out for more than a year. Since Eddie Desktop edition re-downloads client certificates and keys only when the operator logs in, locally some certificates have expired because we extend their expiration date automatically one year in advance.

Please try the following procedure to quickly resolve the problem:

• run Eddie
• on Eddie's main window uncheck "Remember me"
• log your account out
• log your account in (you'll need to re-enter your AirVPN credentials)
• try again a connection

Kind regards
 

Thanks, this solved the problem for me.

[ambiguity 0]

I have renewed the key and can successfully connect to VPN now. But the 'checking authorization' takes much longer than usual (currently about 30 seconds, usually below 10 seconds). Is this because of the certificate problem too ?

[Staff 9972]

4 hours ago, ambiguity said:

I have renewed the key and can successfully connect to VPN now. But the 'checking authorization' takes much longer than usual (currently about 30 seconds, usually below 10 seconds). Is this because of the certificate problem too ?

Hello!

This new problem is unrelated and it is caused by an unexpected sluggishness of the first bootstrap server. We have opened an investigation just while you were writing the message. If the first bootstrap server fails, Eddie will try the second one (timeout: 45 seconds), and then the third one (again 45 seconds timeout) and so on, so everything will work although the initial connection gets delayed.

EDIT: problem was solved at 6 PM CEST.

Kind regards
 

[Andrei Korshikov 0]

I use OpenVPN on Linux (not Eddie), and in my case it was ca.crt. Downloaded new ca.crt from Config Generator page, everything is OK now.

AirVPN Team, huge thanks for your work!

[snadedk 0]

23 hours ago, Staff said:

Hello!

The problem affects those users who run Eddie Desktop edition with OpenVPN and never logged out for more than a year. Since Eddie Desktop edition re-downloads certificates and keys only when the operator logs in, locally some certificates have expired because we extend their expiration date automatically at least one year in advance.

Please try the following procedure to quickly resolve the problem:

• run Eddie
• on Eddie's main window uncheck "Remember me"
• log your account out
• log your account in (you'll need to re-enter your AirVPN credentials)
• try again a connection

Kind regards
 

This solution works perfect - Thanks
Regards