djwcalypso Hello all Yesterday I tried upgrading a working tunnel from 2.2.x (different minor versions at each end) to 2.3.6 at one end. This failed with lots of different TLS errors. Eventually I found the relevant ones to be: Jun 21 12:16:16 [openvpn] VERIFY ERROR: depth=1, could not extract X509 subject string from certificate Jun 21 12:16:16 [openvpn] TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I recreated the endpoint certificates with no effect, then I noticed that the certificate authority no subject, common name etc. I replaced the CA and it all worked fine. Obviously 2.3 is more fussy than 2.2. Is this a bug or a feature 😉 ? If it's a feature then maybe a note in the docs would stop others wasting an afternoon. cheers David
Traffic djwcalypso wroteI replaced the CA and it all worked fine. Did you update from --ns-cert-type to --remote-cert-tls :geek: :?:
djwcalypso No I didn't think of it. Would it have made a difference to the problem or is something I should do anyway? I set SSLclient and SSLserver on all the certificates anyway. It's a point to point link between static ips not a many to one server.
Traffic djwcalypso wrote Yesterday I tried upgrading a working tunnel from 2.2.x (different minor versions at each end) to 2.3.6 at one end. This failed with lots of different TLS errorsProbably best to keep both ends up to date ..
