Svxlink and SvxReflector Issue with Certificates

[HamDigitalNet]

Hi Tobias,
I'm testing the latest version of SvxReflector Server on an Ubuntu aarch64 server and Svxlink on a Raspberry Pi with 32-bit Raspbian.
However, I've seen several topics about this issue, including how to correctly configure the config file by compiling only the Common name file on the server. Svxreflector is running:

SvxReflector v1.3.99.10@25.05.1-69-g44f1dfce Copyright (C) 2003-2025 Tobias Blomberg / SM0SVX

SvxReflector comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it in accordance with the terms and conditions in the
GNU GPL (General Public License) version 2 or later.

Using configuration file: /etc/svxlink/svxreflector.conf
----------- Root CA Certificate ------------
Serial No. : 0x7A7655BE57696833D426340588E52FFB3FEC0B0F
Issuer : CN = SvxReflector Root CA
Subject : CN = SvxReflector Root CA
Not Before : Sun Dec 28 21:44:19 2025
Not After : Thu Dec 22 21:44:19 2050

---------- Issuing CA Certificate ----------
Serial No. : 0x64342DF7E35F2EC91A2C222B530CEAEB3310EE07
Issuer : CN = SvxReflector Root CA
Subject : CN = SvxReflector Issuing CA
Not Before : Sun Dec 28 21:44:19 2025
Not After : Wed Dec 23 21:44:19 2026

------------ Server Certificate ------------
Serial No. : 0x7FED6C7B18AF830FD13231EF238363A229C9478A
Issuer : CN = SvxReflector Issuing CA
Subject : CN = it-hamdigitalnetlab.duckdns.org
Not Before : Sun Dec 28 21:44:19 2025
Not After : Sat Mar 28 21:44:19 2026
Subject Alt Name : DNS:it-hamdigitalnetlab.duckdns.org

NOTICE: Initialization done. Starting main application.

but when I start the client it gives me this error:

Starting logic: ReflectorLogic
Found plugin: /usr/lib/arm-linux-gnueabihf/svxlink/ReflectorLogic.so
*** WARNING[ReflectorLogic]: Failed to read CA file '/var/lib/svxlink/pki/ca-bundle.crt'. Will try to retrieve it from the server.
ReflectorLogic: Loading /usr/share/svxlink/events.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/globals.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/ReflectorLogicType.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/LogicBase.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/locale.tcl
ReflectorLogic: Event handler script successfully loaded.
Activating link 'ReflectorLink' due to DEFAULT_ACTIVE
NOTICE: Initialization done. Starting main application.
ReflectorLogic: Connecting to service

What could be the problem? If anyone can help me, thanks!

[DG1FI]

does /var/lib/svxlink/pki/ca-bundle.crt exist on reflector server?

[f5vmr]

When I first ran this version I had a similar issue. It may also be due to permissions…. I ran the build with root, created the file using touch, and ensured that it had the same ownership and permissions. 73 Chris

…

On 5 Jan 2026, at 11:08, Mario ***@***.***> wrote: DG1FI left a comment (sm0svx/svxlink#743) <#743 (comment)> does /var/lib/svxlink/pki/ca-bundle.crt exist on reflector server? — Reply to this email directly, view it on GitHub <#743 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACAKA5GNRCDAMMTEZKGXV4T4FJA2FAVCNFSM6AAAAACQGBQMQOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTOMBZHE3TQMRWGQ>. You are receiving this because you are subscribed to this thread.

[HamDigitalNet]

does /var/lib/svxlink/pki/ca-bundle.crt exist on reflector server?

@DG1FI Thanks for the reply
The path on the server /var/lib/svxlink/pki/ does not appear to contain ca-bundle.crt.

ubuntu@svxreflectorlab:~$ cd /etc/svxlink/
ubuntu@svxreflectorlab:/etc/svxlink$ ls
TclVoiceMail.conf ca-hook.yaml cert gpio.conf node_info.json remotetrx.conf svxlink.conf svxlink.d svxreflector.conf
ubuntu@svxreflectorlab:/etc/svxlink$ sudo nano svxreflector.conf
ubuntu@svxreflectorlab:/etc/svxlink$ cd /etc/svxlink/cert/
ubuntu@svxreflectorlab:/etc/svxlink/cert$ ls
svxreflector.crt svxreflector.key svxreflector_issuing_ca.csr svxreflector_root_ca.crt
svxreflector.csr svxreflector_issuing_ca.crt svxreflector_issuing_ca.key svxreflector_root_ca.key
ubuntu@svxreflectorlab:/etc/svxlink/cert$ cd /var/lib/svxlink/pki/
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$ ls
certs csrs pending_csrs private
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$ cd certs/
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/certs$ ls
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/certs$ cd ..
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$ cd csrs/
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/csrs$ ls
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/csrs$ cd ..
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$ cd private/
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/private$ ls
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/private$ cd .
ubuntu@svxreflectorlab:/var/lib/svxlink/pki/private$ cd ..
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$ ls
certs csrs pending_csrs private
ubuntu@svxreflectorlab:/var/lib/svxlink/pki$

It is present in these paths:

/home/ubuntu/ca-bundle.crt
/root/ca-bundle.crt

[DG1FI]

I think your cmake path definitions are not correct, here are my first Installation intructions

for debian/Ubuntu the following packages are needed (some are optional) - but i suggest to install all:

git build-essential pkgconf libsigc++-2.0-dev doxygen libspeex-dev libopus-dev libogg-dev libasound2-dev libpopt-dev libgcrypt20-dev librtlsdr-dev libgpiod-dev libjsoncpp-dev tcl tclx8.4-dev curl libcurl4-openssl-dev libgsmme-dev libgsm1-dev libssl-dev ladspa-sdk cmake swh-plugins

after install the packages, you can do the follow steps (as root):

cd /usr/local/src
git clone https://github.com/sm0svx/svxlink.git

groupadd svxlink
useradd -g svxlink -G svxlink,users,audio,tty -d /home/svxlink -s /usr/sbin/nologin -c "SvxLink User" -p svxlink svxlink

and then compile - this is MY update script for svxlink, but it can also use for first install:

#!/bin/bash
cd /usr/local/src/svxlink
git pull
cd /usr/local/src/svxlink/src/
mkdir build
cd build
make clean
cmake -DUSE_QT=OFF -DCMAKE_INSTALL_PREFIX=/usr -DSYSCONF_INSTALL_DIR=/etc -DLOCAL_STATE_DIR=/var -DCMAKE_BUILD_TYPE=Release -DWITH_SYSTEMD=yes -DWITH_CONTRIB_SVXSERVER=OFF ..
make

service svxlink stop

make install

service svxlink start

after that you should enable the service with "systemctl enable svxlink" or "systemctl enable svxreflector" or both. don't forget to edit /etc/svxlink/svxlink.conf or svxreflector.conf.

73 mario
dg1fi

[HamDigitalNet]

@DG1FI Thanks

I completely deleted svxlink on the server and reinstalled it using the provided procedure.
The server is running, but I still get the same error on the client. I noticed that if I manually copy the ca-bundle.crt file on the server to /var/lib/svxlink/pki/, it no longer appears on the client, but it still can't connect to Reflector. I don't see any logs on the server.

Do I need to reinstall svxlink on the client using the same procedure provided? Could the fact that I'm using a 32-bit version of Raspbian be a problem?

Server:

root@svxreflectorlab:~# svxreflector
SvxReflector v1.3.99.12@25.05.1-82-g5381fb85 Copyright (C) 2003-2025 Tobias Blomberg / SM0SVX

SvxReflector comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it in accordance with the terms and conditions in the
GNU GPL (General Public License) version 2 or later.

Using configuration file: /etc/svxlink/svxreflector.conf
----------- Root CA Certificate ------------
Serial No. : 0x50549B2D16477EEECE36D0725DDEAFBEB35B78B6
Issuer : CN = SvxReflector Root CA, OU = SvxLink, O = Corp, L = IT, ST = IT, C = IT
Subject : CN = SvxReflector Root CA, OU = SvxLink, O = Corp, L = IT, ST = IT, C = IT
Not Before : Tue Jan 6 21:19:03 2026
Not After : Sat Dec 31 21:19:03 2050
Subject Alt Name : email:hamdigitalnetwork@gmail.com

---------- Issuing CA Certificate ----------
Serial No. : 0x4FAC9B1239DCF02C7897AB31B80898108262E88F
Issuer : CN = SvxReflector Root CA, OU = SvxLink, O = Corp, L = IT, ST = IT, C = IT
Subject : CN = SvxReflector Issuing CA, OU = SvxLink, O = Corp, L = IT, ST = IT, C = IT
Not Before : Tue Jan 6 21:19:03 2026
Not After : Fri Jan 1 21:19:03 2027
Subject Alt Name : email:hamdigitalnetwork@gmail.com

------------ Server Certificate ------------
Serial No. : 0x4DB352E532A68DBA86FFA0DDE55D6E00BCA38BC2
Issuer : CN = SvxReflector Issuing CA, OU = SvxLink, O = Corp, L = IT, ST = IT, C = IT
Subject : CN = it-hamdigitalnetlab.duckdns.org
Not Before : Tue Jan 6 21:19:03 2026
Not After : Mon Apr 6 21:19:03 2026
Subject Alt Name : DNS:it-hamdigitalnetlab.duckdns.org, DNS:it-hamdigitalnetlab.duckdns.org, IP Address:130.110.8.189, email:hamdigitalnetwork@gmail.com

NOTICE: Initialization done. Starting main application.

Client (Raspberry)

sudo svxlink
SvxLink v1.9.99.36@25.05.1-69-g44f1dfce Copyright (C) 2003-2025 Tobias Blomberg / SM0SVX

SvxLink comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it in accordance with the terms and conditions in the
GNU GPL (General Public License) version 2 or later.

Using configuration file: /etc/svxlink/svxlink.conf
--- Using sample rate 48000Hz

Starting logic: SimplexLogic
Found plugin: /usr/lib/arm-linux-gnueabihf/svxlink/SimplexLogic.so
SimplexLogic: Loading RX "Rx1"
--- Hidraw sound chip is CM108A
Rx1: Delay line (for DTMF muting etc) set to 40 ms
SimplexLogic: Loading TX "Tx1"
--- Hidraw sound chip is CM108A
SimplexLogic: Loading module "ModuleHelp"
Found /usr/lib/arm-linux-gnueabihf/svxlink/ModuleHelp.so
Module Help v1.0.0.99.1@25.05.1-69-g44f1dfce starting...
SimplexLogic: Loading module "ModuleParrot"
Found /usr/lib/arm-linux-gnueabihf/svxlink/ModuleParrot.so
Module Parrot v1.1.1.99.2@25.05.1-69-g44f1dfce starting...
SimplexLogic: Loading /usr/share/svxlink/events.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/globals.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/SimplexLogicType.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/Logic.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/LogicBase.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/locale.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/CW.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/Help.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/Module.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/Parrot.tcl
SimplexLogic: Loading /usr/share/svxlink/events.d/Module.tcl
SimplexLogic: Event handler script successfully loaded.

Starting logic: ReflectorLogic
Found plugin: /usr/lib/arm-linux-gnueabihf/svxlink/ReflectorLogic.so
ReflectorLogic: Certificate key file not found. Generating key file "/var/lib/svxlink/pki/ITXX01.key"
ReflectorLogic: Saving certificate signing request file '/var/lib/svxlink/pki/ITXX01.csr'
*** WARNING[ReflectorLogic]: Failed to read CA file '/var/lib/svxlink/pki/ca-bundle.crt'. Will try to retrieve it from the server.
ReflectorLogic: Loading /usr/share/svxlink/events.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/globals.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/ReflectorLogicType.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/LogicBase.tcl
ReflectorLogic: Loading /usr/share/svxlink/events.d/locale.tcl
ReflectorLogic: Event handler script successfully loaded.
Activating link 'ReflectorLink' due to DEFAULT_ACTIVE
NOTICE: Initialization done. Starting main application.
ReflectorLogic: Connecting to service