Hi all
I have an OpenVPN Server running on my dd-wrt router, and using my macbook as an openVPN client. All was working fine until I decided to create new certificates because I needed to add a second client and couldn't remember how I made the first set of certificates.
Other than the certificates, the only things that are different is I am no longer TLS auth, so I removed that from the client config.
I've spent ages googling but my knowledge on this subject is limited and I cannot see what the issue is.
Thanks in advance for help
Server config:
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp
cipher bf-cbc
auth md5
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server-bridge 192.168.10.1 255.255.255.0 192.168.10.50 192.168.10.60
dev tap2
Client config:
remote xxxxx.freeddns.org 1194
client
dev tap
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
auth md5
comp-lzo yes
verb 4
ca ca.crt
cert macbook.crt
key macbook.key
ns-cert-type server
How I set up the certificates:
I followed the Mac instructions here
https://www.sparklabs.com/support/kb/article/creating-certificates-and-keys-for-your-openvpn-server/
Extract from client log:
2016-10-30 12:13:45 *Tunnelblick: openvpnstart starting OpenVPN
2016-10-30 12:13:46 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2016-10-30 12:13:46 *Tunnelblick: Established communication with OpenVPN
2016-10-30 12:13:46 MANAGEMENT: CMD 'pid'
2016-10-30 12:13:46 MANAGEMENT: CMD 'state on'
2016-10-30 12:13:46 MANAGEMENT: CMD 'state'
2016-10-30 12:13:46 MANAGEMENT: CMD 'bytecount 1'
2016-10-30 12:13:46 MANAGEMENT: CMD 'hold release'
2016-10-30 12:13:46 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2016-10-30 12:13:46 Socket Buffers: R=[196724->196724] S=[9216->9216]
2016-10-30 12:13:46 MANAGEMENT: >STATE:1477829626,RESOLVE,,,
2016-10-30 12:13:46 UDPv4 link local: [undef]
2016-10-30 12:13:46 UDPv4 link remote: [AF_INET]79.68.8.89:1194
2016-10-30 12:13:46 MANAGEMENT: >STATE:1477829626,WAIT,,,
2016-10-30 12:13:46 MANAGEMENT: >STATE:1477829626,AUTH,,,
2016-10-30 12:13:46 TLS: Initial packet from [AF_INET]192.168.10.1:1194, sid=34fbbc6d 7691e049
2016-10-30 12:13:46 VERIFY OK: depth=1, CN=server
2016-10-30 12:13:46 VERIFY nsCertType ERROR: CN=server, require nsCertType=SERVER
2016-10-30 12:13:46 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
2016-10-30 12:13:46 TLS_ERROR: BIO read tls_read_plaintext error
2016-10-30 12:13:46 TLS Error: TLS object -> incoming plaintext read error
2016-10-30 12:13:46 TLS Error: TLS handshake failed
2016-10-30 12:13:46 SIGUSR1[soft,tls-error] received, process restarting
2016-10-30 12:13:46 MANAGEMENT: >STATE:1477829626,RECONNECTING,tls-error,,
2016-10-30 12:13:46 MANAGEMENT: CMD 'hold release'
Extract from server log:
20161030 12:14:53 N 192.168.10.100:54234 TLS Error: TLS handshake failed
20161030 12:14:53 192.168.10.100:54234 SIGUSR1[soft tls-error] received client-instance restarting
20161030 12:14:53 N 192.168.10.100:57013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
