Client on embedded system does not connect

_David_

Hi,
I'm trying to set up an openvpn client on an embedded system.
The embedded system is a Freescale/NXP T1042 CPU running a custom Linux image built with Yocto poky-daisy. OpenVpn 2.1.3, OpenSSL 1.0.1g.
The server is a regular x86 PC running an Ubuntu 12.04.5. Openvpn 2.2.1, OpenSSL 1.0.1 14 Mar 2012.

The problem is the client never creates a tun interface as expected.
The client log shows lots of certificate verification failures which is, i guess, the cause of the malfunction.
But I'm pretty sure that there is nothing wrong with the certificates because:

Client with the exact same configuration (conf file and certificates, keys...) runs flawlessly when put on an Ubuntu PC.
Weird thing, when the client runs on the embedded system, the log shows lots of certificate verification failures and some certificate verification successes.

Any clue about what might be wrong?

server.conf=

port 1194
proto udp
dev tun
ca ca.crt
cert myServer.crt
key myServer.key
dh dh2048.pem
server 192.170.1.0 255.255.255.0
push "route 192.170.1.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
duplicate-cn
keepalive 10 120
tls-auth ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup

client.conf=

client
dev tun
remote 10.140.4.2 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert myClient.crt
key myClient.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-128-CBC
comp-lzo

extract of client.log (verb=6)=

14:24:14 UDPv4 link remote: 10.140.4.2:1194
    ...
    VERIFY OK: depth=1, /C=../ST=.../L=.../O=.../OU=.../CN=_CA/name=.../emailAddress=...
    VERIFY ERROR: depth=0, error=certificate signature failure: /C=../ST=.../L=.../O=.../OU=.../CN=_Server/name=.../emailAddress=...
    TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
    TLS Error: TLS object -> incoming plaintext read error
    TLS Error: TLS handshake failed
    TCP/UDP: Closing socket
    SIGUSR1[soft,tls-error] received, process restarting
14:24:14 Restart pause, 2 second(s)
...
14:24:16
    ...
    VERIFY OK: depth=1, /C=../ST=.../L=.../O=.../OU=.../CN=_CA/name=.../emailAddress=...
    VERIFY OK: nsCertType=SERVER
    VERIFY OK: depth=0, error=certificate signature failure: /C=../ST=.../L=.../O=.../OU=.../CN=_Server/name=.../emailAddress=...
    UDPv4 WRITE [50] to 10.140.4.2:1194: P_ACK_V1 kid=0 pid=[ #35 ] [ 30 ]
    UDPv4 READ [142] from 10.140.4.2:1194: P_CONTROL_V1 kid=0 pid=[ #34 ] [ ] pid=31 DATA len=100
    ...
    TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
    TLS Error: TLS handshake failed
    TCP/UDP: Closing socket
14:24:16 Restart pause, 2 second(s)

mwandelaar

I'm triggered by this piece of the error:

VERIFY ERROR: depth=0, error=certificate signature failure

Does the server-certificate have a signature-algoritm that's not supported (not compiled?) by the older sofware-versions on the FreeScale machine?

The setup looks good, you confirmed it works on another system, so the only part left is the old software and probably the way it's build. Can you build newer versions?

_David_

Thanks for answering.
At first, I created certificates whit md5 signatures. I encountered similar problems. Some internet search taught me md5 signatures where deprecated and support was removed from some systems (e.g. here: https://www.centos.org/forums/viewtopic.php?t=47210).
Thus I switched to sha256 signatures. Actually, i installed easy-rsa on my Ubuntu (easy-rsa:all/trusty 2.2.2-1 uptodate), which comes with default_md = sha256 in openssl-1.0.0.cnf. So i am using sha256 signatures now.
What's puzzling me is that the client sometimes successes to verify server's certificate as show in the 14:24:16 part of the log provided. Doesn't it invalidate the "signature-algoritm not compiled" hypothesis?
I also recompiled openvpn 2.1.3 on my Ubuntu client, which was easier than build a newer version for the freescale machine. It didn't show anything interesting though.
Anyway I'll look into both openssl and openvpn compilation logs. And try to build newer versions.
In the meantime, with that extra info, do you feel i am following the right track?

mwandelaar

I think you're following the right track.
However, you stated that sometimes validation succeeded, but it does not. In both of the situations it gives the same error. Allthough in the log on 14:24:16 it first validates the server-certificate as a Netscape Server type (nsCertType server) and then it complains about the signature. Another detail which might help:

VERIFY OK: depth=1, /C=../ST=.../L=.../O=.../OU=.../CN=_CA/name=.../emailAddress=...
VERIFY ERROR: depth=0, error=certificate signature failure: /C=../ST=.../L=.../O=.../OU=.../CN=_Server/name=.../emailAddress=...

Verify OK: Depth 1 is the validation of the server-certificate against the CA-file. This succeeded.
Verify ERROR: depth 0 is the validation of the issuing CA against the CA-file.
So i think it has an issue with the rootCA.
Do you see any errors in the server-logs? Maybe with increased verbose-level?

TinCanTech

mwandelaar wroteDo you see any errors in the server-logs? Maybe with increased verbose-level?

Your complete logs as per HOWTO: Request Help ! is what is required.

A much simpler solution would be to recreate your PKI from scratch ..