Config not working

LonelyPixel

Hello,

I'm currently trying to set up a new OpenVPN instance on my Raspberry Pi. It's running on the Raspbian Linux system, I'm connecting with the Windows client and I have created the keys with xca. Each of these have worked in the past. I have another OpenVPN server running on Linux (keys created with that easy rsa script somewhere) and Windows; the Windows client can connect to both of them; and I have created CAs, keys and signed certs with xca for https and Windows Authenticode (code signing).

However, today it doesn't work. Here's the probably most interesting line from the client log:

TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

I have absolutely no idea what that thing is trying to tell me. Can you tell me?

Here's more info. The server config:

dev tap
port 1194
proto tcp
ca pi_ca.crt
cert pi_server.crt
key pi_server.key
dh dh2048.pem
server-bridge 192.168.81.1 255.255.255.0 192.168.81.230 192.168.81.240
client-to-client
keepalive 10 50
comp-lzo
persist-tun
persist-key
verb 4
log /var/log/openvpn.log
status /var/log/openvpn-status.log

(Based on the working Windows server config. I know this is somewhat suboptimal, it will be changed for tcp/443 later.)

The client config:

client
dev tap
proto tcp
remote raspberrypi 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca pi-keys/pi_ca.crt
cert pi-keys/pi_client.crt
key pi-keys/pi_client.key
comp-lzo
verb 3

The complete client log:

Fri Apr 18 20:59:59 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jun 3 2013
Enter Management Password:
Fri Apr 18 20:59:59 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25344
Fri Apr 18 20:59:59 2014 Need hold release from management interface, waiting...
Fri Apr 18 20:59:59 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25344
Fri Apr 18 20:59:59 2014 MANAGEMENT: CMD 'state on'
Fri Apr 18 20:59:59 2014 MANAGEMENT: CMD 'log all on'
Fri Apr 18 20:59:59 2014 MANAGEMENT: CMD 'hold off'
Fri Apr 18 20:59:59 2014 MANAGEMENT: CMD 'hold release'
Fri Apr 18 20:59:59 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Apr 18 20:59:59 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Apr 18 20:59:59 2014 MANAGEMENT: >STATE:1397847599,RESOLVE,,,
Fri Apr 18 20:59:59 2014 Attempting to establish TCP connection with [AF_INET]192.168.81.22:1194
Fri Apr 18 20:59:59 2014 MANAGEMENT: >STATE:1397847599,TCP_CONNECT,,,
Fri Apr 18 20:59:59 2014 TCP connection established with [AF_INET]192.168.81.22:1194
Fri Apr 18 20:59:59 2014 TCPv4_CLIENT link local: [undef]
Fri Apr 18 20:59:59 2014 TCPv4_CLIENT link remote: [AF_INET]192.168.81.22:1194
Fri Apr 18 20:59:59 2014 MANAGEMENT: >STATE:1397847599,WAIT,,,
Fri Apr 18 21:00:00 2014 MANAGEMENT: >STATE:1397847600,AUTH,,,
Fri Apr 18 21:00:00 2014 TLS: Initial packet from [AF_INET]192.168.81.22:1194, sid=55e63dbc a77790f7
Fri Apr 18 21:00:01 2014 VERIFY ERROR: depth=1, could not extract X509 subject string from certificate
Fri Apr 18 21:00:01 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Fri Apr 18 21:00:01 2014 TLS Error: TLS object -> incoming plaintext read error
Fri Apr 18 21:00:01 2014 TLS Error: TLS handshake failed
Fri Apr 18 21:00:01 2014 Fatal TLS error (check_tls_errors_co), restarting
Fri Apr 18 21:00:01 2014 SIGUSR1[soft,tls-error] received, process restarting
Fri Apr 18 21:00:01 2014 MANAGEMENT: >STATE:1397847601,RECONNECTING,tls-error,,
Fri Apr 18 21:00:01 2014 Restart pause, 5 second(s)
(second try...)
Fri Apr 18 21:00:08 2014 SIGTERM[hard,init_instance] received, process exiting
Fri Apr 18 21:00:08 2014 MANAGEMENT: >STATE:1397847608,EXITING,init_instance,,

The last part of the server log: (server version is 2.2.1-8+deb7u2)

Fri Apr 18 21:00:01 2014 us=70323 MULTI: multi_create_instance called
Fri Apr 18 21:00:01 2014 us=70970 Re-using SSL/TLS context
Fri Apr 18 21:00:01 2014 us=71421 LZO compression initialized
Fri Apr 18 21:00:01 2014 us=73023 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Fri Apr 18 21:00:01 2014 us=73699 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Apr 18 21:00:01 2014 us=74332 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Apr 18 21:00:01 2014 us=74616 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Apr 18 21:00:01 2014 us=75168 Local Options hash (VER=V4): '3e6d1056'
Fri Apr 18 21:00:01 2014 us=75699 Expected Remote Options hash (VER=V4): '31fdf004'
Fri Apr 18 21:00:01 2014 us=76171 TCP connection established with [AF_INET]192.168.81.10:49527
Fri Apr 18 21:00:01 2014 us=76583 TCPv4_SERVER link local: [undef]
Fri Apr 18 21:00:01 2014 us=77014 TCPv4_SERVER link remote: [AF_INET]192.168.81.10:49527
Fri Apr 18 21:00:01 2014 us=79163 192.168.81.10:49527 TLS: Initial packet from [AF_INET]192.168.81.10:49527, sid=c8cfae37 edf80b2d
Fri Apr 18 21:00:01 2014 us=941829 192.168.81.10:49527 Connection reset, restarting [0]
Fri Apr 18 21:00:01 2014 us=942042 192.168.81.10:49527 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Apr 18 21:00:01 2014 us=942542 TCP/UDP: Closing socket

I can send you the CA, cert and key files to try it yourself if you want (or the complete xca database). I can recreate those files at any time. It's 2048 bit RSA keys, signed by a CA I also created.

LonelyPixel

Oh, I thought you might be able to explain OpenVPN's error message to me as the software failed to do so.