Hello
I configured a certificate based authentication with username & password on a Synology NAS. I've got a working openvpn config on IOS (LAN & Outside of LAN). I use the same config with the same certificates and static key (ta.key) on my Macbook (MacOS Sierra). But I doesn't work (tested with Tunnelblick & Shimo to be sure it isn't a openvpn client problem). I haven't tried the config on Windows.
Client logs:
Mon Oct 10 10:23:50 2016 TLS: Initial packet from [AF_INET]XXX:1194, sid=12a6b90d ab49b17b
Mon Oct 10 10:23:50 2016 VERIFY ERROR: depth=0, error=self signed certificate: C=CH, ST=XXX, L=XXX, O=XXX, OU=XXX, CN=XXX, emailAddress=XXX
Mon Oct 10 10:23:50 2016 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Mon Oct 10 10:23:50 2016 TLS_ERROR: BIO read tls_read_plaintext error
Mon Oct 10 10:23:50 2016 TLS Error: TLS object -> incoming plaintext read error
Mon Oct 10 10:23:50 2016 TLS Error: TLS handshake failed
Mon Oct 10 10:23:50 2016 SIGUSR1[soft,tls-error] received, process restarting
Mon Oct 10 10:23:50 2016 MANAGEMENT: >STATE:1476087830,RECONNECTING,tls-error,,
Mon Oct 10 10:23:50 2016 MANAGEMENT: CMD 'hold release'
Mon Oct 10 10:23:50 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Oct 10 10:23:50 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Oct 10 10:23:50 2016 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Oct 10 10:23:50 2016 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Oct 10 10:23:50 2016 Socket Buffers: R=[196724->196724] S=[9216->9216]
Mon Oct 10 10:23:50 2016 MANAGEMENT: >STATE:1476087830,RESOLVE,,,
Mon Oct 10 10:23:50 2016 UDPv4 link local (bound): [undef]
Mon Oct 10 10:23:50 2016 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Mon Oct 10 10:23:50 2016 MANAGEMENT: >STATE:1476087830,WAIT,,,
Mon Oct 10 10:23:53 2016 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
Mon Oct 10 10:23:53 2016 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
Mon Oct 10 10:23:54 2016 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
Mon Oct 10 10:23:54 2016 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
Mon Oct 10 10:23:57 2016 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
OpenVPN Config
dev tun
tls-client
pull
remote XXX 1194
proto udp
script-security 1
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
tls-version-min 1.2
redirect-gateway
auth-user-pass
comp-lzo
reneg-sec 0
cipher AES-256-CBC
auth SHA256
I already changed auth to SHA1 (default), removed tls-version-min, script-security to 3, but nothing worked.
server.conf (It's the same in /usr/syno/etc/packages/VPNCenter/openvpn and /var/packages/VPNCenter/target/etc/openvpn)
dev tun
management 127.0.0.1 1195
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh4096.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key
tls-auth /var/packages/VPNCenter/target/etc/openvpn/keys/ta.key 0
max-clients 5
comp-lzo
persist-tun
persist-key
verb 3
log /var/log/openvpn.log
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn
cipher AES-256-CBC
auth SHA256
remote-cert-tls server
status /tmp/ovpn_status_2_result 30
status-version 2
port 1194
proto udp6
I would really appreciate, if someone has a solution.
