PolarSSL error: "Bad input parameters to function"

falzm

Hello all

I'm new to Android, and I have a problem trying to use OpenVPN Connect on my OnePlus One:

OpenVPN core error : PolarSSL: error parsing config private key : PK - Bad input parameters to function.

As I'm also quite unfamiliar with OpenVPN, I might have done an error in the .ovpn file I've written to import it in the app (I've found some info gathered on the internet):

client
dev tun
remote 1.2.3.4 1194
resolv-retry infinite
nobind
comp-lzo
persist-key
persist-tun
verb 1
keepalive 10 900
inactive 3600
comp-lzo

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
</key>

Certs/keys are good, I successfully use them on my main computer.

OpenVPN Connect 1.1.15 (build 62)
OpenVPN core 3.0.3 android armv7a

Let me know if you need more information on my setup/phone.

Thank you in advance for your help,

m.

androuser88

Which android version ? rooted ? unrooted ?

falzm

Android 4.4.4 (Cyanogen OS 11.0-XNPH05Q)

preusstang

I am seeing this same error. Latest version of OpenVPN Connect, Android 4.4.4, rooted. Works with other configurations but refuses to use an encrypted private key. It seems to be failing on decrypt.

falzm

androuser88 wroteWhich android version ? rooted ? unrooted ?

Android 4.4.4, CyanogenMod 11.0-XNPH05Q. Unrooted.

falzm

I found out what the problem was: the embedded RSA key was password-protected, looks like PolarSSL doesn't like this. Using the unprotected RSA works.

meckl

I get the same Error, too.

I tryed different types of options in the client and server config, but nothing funktions.

The Server is running well without problems. The cert/keys are good, running well on my desktop pc (debian7).

- OpenVPN Connect 1.1.15 (build 62)
- OpenVPN core 3.0.3 android armv7a thumb2 32-bit

- Samsung Galaxy S3 (GT-I9300)
- CyanogenMod Version: (11-20140830-NIGHTLY-i9300)
- Android Version: 4.4.4
- Kernel-Version: 3.0.101-CM Boeffla-Kernel-2.3a
- Rooted: Yes

Here is my Client Config:

Did i make some mistakes with the tls-auth or some hardening funktions?
On a basic test setup (with small keysize (1024)), without hardening and so on, it worked great...
But i can't figure out which option is breaking my setup now...

client
proto udp
dev tun
remote REMOTE_IP 1194
resolv-retry infinite
nobind
auth-nocache
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
user nobody
group nogroup
reneg-sec 0
auth SHA512
cipher AES-256-CBC
comp-lzo
verb 3
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

Here is the OpenVPN Connect Log File

-- ----- OpenVPN Start -----
-- EVENT: CORE_THREAD_ACTIVE
-- EVENT: CORE_THREAD_ERROR
info='PolarSSL: error parsing config private key : PK - Bad input parameters to function'
-- EVENT: CORE_THREAD_INACTIVE
-- Tunnel bytes per CPU second: 0
-- -----OpenVPN Stop -----

--EVENT:

meckl

I had the same error and fixed it with des3 encryption.

openssl rsa -in Client1.key -des3 -out Client1.3des.key

Than change your config with the new 3des.key...

Example:

...
...
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,D6CE19D6AE4FA313
...
...
-----END RSA PRIVATE KEY-----
</key>
...
...