client config works on windows and fails on linux

tkoeppe

Hello,

I have setup a OpenVPN server on windows and created some client configs to be used on windows an linux (CentOS 6). OpenVPN is 2.3.10 on all systems. All windows clients successfully connect to the server, but not the linux client. When I use the linux client configuration on windows it works fine.

On CentOS the log shows this:

Sat Feb 13 19:57:07 2016 OpenVPN 2.3.10 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  4 2016
Sat Feb 13 19:57:07 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Sat Feb 13 19:57:07 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Feb 13 19:57:07 2016 TUN/TAP device tun0 opened
Sat Feb 13 19:57:07 2016 TUN/TAP TX queue length set to 100
Sat Feb 13 19:57:07 2016 UDPv4 link local: [undef]
Sat Feb 13 19:57:07 2016 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Sat Feb 13 19:57:07 2016 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:1194, sid=81a9455c de6c5744
Sat Feb 13 19:57:07 2016 VERIFY OK: depth=1, C=DE, ST=BW, L=MyCity, O=Company Name, OU=myOU, CN=vpnserver, name=vpnserver, emailAddress=my@email.de
Sat Feb 13 19:57:07 2016 VERIFY ERROR: depth=0, error=certificate signature failure: C=DE, ST=BW, L=MyCity, O=Company Name, OU=myOU, CN=vpnserver, name=vpnserver, emailAddress=my@email.de
Sat Feb 13 19:57:07 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sat Feb 13 19:57:07 2016 TLS Error: TLS object -> incoming plaintext read error
Sat Feb 13 19:57:07 2016 TLS Error: TLS handshake failed
Sat Feb 13 19:57:07 2016 SIGUSR1[soft,tls-error] received, process restarting

The client configuration:

remote my.vpnserver.de
dev tun
nobind
tls-client
remote-cert-tls server
ca   ca.crt
cert client.crt
key  client.key
persist-tun
persist-key
comp-lzo
verb 3

Any ideas whats wrong with the linux client?

Best Regards
Tilo

Pippin

Nothing wrong with the client but look like something wrong with your certificates.

Sat Feb 13 19:57:07 2016 VERIFY OK: depth=1, C=DE, ST=BW, L=......................
Sat Feb 13 19:57:07 2016 VERIFY ERROR: depth=0
, error=certificate signature failure................

tkoeppe

I noticed the verify error in log, but the same (really the same) certificates work fine wit OpenVPN on windows, so I can't see whats wrong ...
I also tried a completeley new server setup with new certificates (killed the easy-rsa/keys directory), but with the same results.

Traffic

Try this on your Linux client:

$ sudo openssl verify -CAfile ca.crt client.crt

tkoeppe

"openssl verify -CAfile ca.crt client.crt" gives this result:

client.crt: C = DE, ST = BW, L = MyCity, O = Company Name, OU = myOU, CN = client, name = client, emailAddress = my@email.de
error 7 at 0 depth lookup:certificate signature failure
140176128698272:error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm:a_verify.c:191:

This lead me to the insight that the problem is the missing MD5 support in openssl on linux. My CA is the windows server and the "openssl.cnf" there declares MD5 as default, while on linux its SHA256.

Thanks for your support.

Traffic

Did you find a solution to this ?