Hi,
I've been having trouble with my new setup, and decided to start from scratch using this page as reference:
https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6
And it is not connecting. I suspect an issue with the certs, but I'm not sure how to fix it.
as such, my client config is:
client
dev tun
proto tcp
remote 127.0.0.1 11194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "c:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "c:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\client01.crt"
key "c:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\client01.key"
ns-cert-type server
comp-lzo
verb 4
server config is:
port 11194
remote-cert-tls server
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
user nobody
group nobody
server 10.56.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.10.100.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
logfile on the client shows this set of messages, repeating:
Tue Jul 19 12:01:31 2016 us=443000 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jul 19 12:01:31 2016 us=443000 Restart pause, 5 second(s)
Tue Jul 19 12:01:36 2016 us=450000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 19 12:01:36 2016 us=450000 Re-using SSL/TLS context
Tue Jul 19 12:01:36 2016 us=450000 LZO compression initialized
Tue Jul 19 12:01:36 2016 us=450000 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Jul 19 12:01:36 2016 us=450000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jul 19 12:01:36 2016 us=450000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Jul 19 12:01:36 2016 us=450000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Jul 19 12:01:36 2016 us=450000 Local Options hash (VER=V4): '69109d17'
Tue Jul 19 12:01:36 2016 us=450000 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Jul 19 12:01:36 2016 us=450000 Attempting to establish TCP connection with 127.0.0.1:11194
Tue Jul 19 12:01:36 2016 us=450000 TCP connection established with 127.0.0.1:11194
Tue Jul 19 12:01:36 2016 us=450000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jul 19 12:01:36 2016 us=450000 TCPv4_CLIENT link local: [undef]
Tue Jul 19 12:01:36 2016 us=450000 TCPv4_CLIENT link remote: 127.0.0.1:11194
Tue Jul 19 12:01:36 2016 us=450000 TLS: Initial packet from 127.0.0.1:11194, sid=39841482 d5f6786d
Tue Jul 19 12:01:36 2016 us=481000 VERIFY OK: depth=1, /C=US/ST=AZ/L=Tucson/O=Vaisala/OU=tuxopenvpn2/CN=Vaisala_CA/name=EasyRSA/emailAddress=
tuxmaster@vaisala.com
Tue Jul 19 12:01:36 2016 us=481000 VERIFY OK: nsCertType=SERVER
Tue Jul 19 12:01:36 2016 us=481000 VERIFY OK: depth=0, /C=US/ST=AZ/L=Tucson/O=Vaisala/OU=tuxopenvpn2/CN=server/name=EasyRSA/emailAddress=
tuxmaster@vaisala.com
Tue Jul 19 12:01:36 2016 us=653000 Connection reset, restarting [0]
Tue Jul 19 12:01:36 2016 us=653000 TCP/UDP: Closing socket
Tue Jul 19 12:01:36 2016 us=653000 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jul 19 12:01:36 2016 us=653000 Restart pause, 5 second(s)
On the server side, I see lots of messages, but this one stands out:
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 Validating certificate key usage
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 ++ Certificate has key usage 0080, expects 00a0
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 ++ Certificate has key usage 0080, expects 0088
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 VERIFY KU ERROR
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS_ERROR: BIO read tls_read_plaintext error
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS Error: TLS object -> incoming plaintext read error
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS Error: TLS handshake failed
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 Fatal TLS error (check_tls_errors_co), restarting
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: TCP/UDP: Closing socket
All the server messages are here, repeating:
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: Local Options hash (VER=V4): 'c0103fa8'
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: Expected Remote Options hash (VER=V4): '69109d17'
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: TCP connection established with [AF_INET]127.0.0.1:50812
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: TCPv4_SERVER link local: [undef]
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: TCPv4_SERVER link remote: [AF_INET]127.0.0.1:50812
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS: Initial packet from [AF_INET]127.0.0.1:50812, sid=614835ae 59a10223
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 VERIFY OK: depth=1, C=US, ST=AZ, L=Tucson, O=Vaisala, OU=tuxopenvpn2, CN=Vaisala CA, name=EasyRSA, emailAddress=
tuxmaster@vaisala.com
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 Validating certificate key usage
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 ++ Certificate has key usage 0080, expects 00a0
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 ++ Certificate has key usage 0080, expects 0088
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 VERIFY KU ERROR
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS_ERROR: BIO read tls_read_plaintext error
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS Error: TLS object -> incoming plaintext read error
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 TLS Error: TLS handshake failed
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 Fatal TLS error (check_tls_errors_co), restarting
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: 127.0.0.1:50812 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 19 19:01:36 tuxopenvpn2 openvpn[1458]: TCP/UDP: Closing socket
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: MULTI: multi_create_instance called
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: Re-using SSL/TLS context
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: LZO compression initialized
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: Control Channel MTU parms [ L:1544 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ]
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Jul 19 19:01:41 tuxopenvpn2 openvpn[1458]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
