TLS Error when connecting

who93

Hi,

I have installed an OpenVPN server successfully on my server and I am using it with the network-manager on my laptop.
Here is the server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert MyVPN.crt
key MyVPN.key 
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3

And my local config of the network-manger:

[vpn]
ca=/openvpn/ca.crt
cert=/openvpn/user.crt
cert-pass-flags=1
comp-lzo=yes
connection-type=tls
key=/openvpn/user.key
port=1194
remote=myip.net
tunnel-mtu=1500
service-type=org.freedesktop.NetworkManager.openvpn
[ipv4]
dns=8.8.8.8;
dns-search=
method=auto

Now I want to connect to my OpenVPN server from a other computer with the command line. So I copied ca.crt, user.crt and user.key to /etc/openvpn and created the client.conf in /etc/openvpn/client.conf:

port 1194
remote myip.net
proto udp
dev tun
ca ca.crt
cert user.crt
key user.key
comp-lzo
status openvpn-status.log
verb 3
tun-mtu 1500
#mssfix 1400
dhcp-option DNS 8.8.8.8

Then I start OpenVPN with openvpn --config client.conf --tls-client, here is the output of the console:

openvpn --config client.conf --tls-client
Thu Feb 16 11:29:14 2017 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Thu Feb 16 11:29:14 2017 WARNING: file 'user.key' is group or others accessible
Thu Feb 16 11:29:14 2017 OpenVPN 2.4.0 [git:master/f5bf296bacce76a8+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 29 2016
Thu Feb 16 11:29:14 2017 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.08
Thu Feb 16 11:29:14 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 16 11:29:14 2017 TUN/TAP device tun0 opened
Thu Feb 16 11:29:14 2017 TUN/TAP TX queue length set to 100
Thu Feb 16 11:29:14 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]IP
Thu Feb 16 11:29:14 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 16 11:29:14 2017 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 16 11:29:14 2017 UDP link remote: [AF_INET]IP
Thu Feb 16 11:29:14 2017 TLS: Initial packet from [AF_INET]IP:1194, sid=ee22c562 44024d16
Thu Feb 16 11:29:14 2017 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Feb 16 11:29:14 2017 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=MyVPN, name=EasyRSA, emailAddress=me@myhost.mydomain

And here the server log:

Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 TLS: Initial packet from [AF_INET]IP:1194, sid=e2cc1cac 36412abf
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client, name=EasyRSA, emailAddress=me@myhost.mydomain
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 TLS_ERROR: BIO read tls_read_plaintext error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 TLS Error: TLS object -> incoming plaintext read error
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 TLS Error: TLS handshake failed
Feb 16 05:31:19 vpn ovpn-server[7045]: IP:1194 SIGUSR1[soft,tls-error] received, client-instance restarting

Any idea what is going wrong?

TinCanTech

Add --client to your client.

who93

Hi,

I've tried it, but still the same problem and no connection:

openvpn --client --config client.conf
Thu Feb 16 19:30:38 2017 WARNING: file 'client.key' is group or others accessible
Thu Feb 16 19:30:38 2017 OpenVPN 2.4.0 [git:master/f5bf296bacce76a8+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 29 2016
Thu Feb 16 19:30:38 2017 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.08
Thu Feb 16 19:30:38 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 16 19:30:38 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]IP:1194
Thu Feb 16 19:30:38 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 16 19:30:38 2017 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 16 19:30:38 2017 UDP link remote: [AF_INET]IP:1194
Thu Feb 16 19:30:38 2017 TLS: Initial packet from [AF_INET]IP:1194, sid=1b25fcad 80b64d81
Thu Feb 16 19:30:38 2017 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Feb 16 19:30:38 2017 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=VPN, name=EasyRSA, emailAddress=me@myhost.mydomain

Server:

Feb 16 13:29:36 vpn ovpn-server[7045]: IP:1194 TLS_ERROR: BIO read tls_read_plaintext error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac
Feb 16 13:29:36 vpn ovpn-server[7045]: IP:1194 TLS Error: TLS object -> incoming plaintext read error
Feb 16 13:29:36 vpn ovpn-server[7045]: IP:1194 TLS Error: TLS handshake failed

Thank you for your help

TinCanTech

? openvpn --version

who93

openvpn --version
OpenVPN 2.4.0 [git:master/f5bf296bacce76a8+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 29 2016
library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no

SomeGuy

Some questions/comments:

I notice the date/time in the logs does not match. It is possible for time zone differences to account for some differences. Please check to make sure that time is synchronized on both client and server with the same NTP servers, and for future logs reports, include the server logs from the same time as the client logs, so there is a good comparison for each side. (Different timezones should not matter, so long as the OS and NTP are working with thier respective time zones.)

Next, as a test, would you be willing to try explicitly adding entries for "cipher" and "tls-cipher" in your server config and restart your openvpn server service with that change, and then alter your client config to explicitly include the same cipher?

According to the openvpn man page, the default for "tls-cipher" when openvpn uses openssl is 'DEFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA' you could try explicitly including that or maybe try 'HIGH:!SHA:!MD5:!AES128'

Example suggestions for server config additions with explicit values instead of relying on assumed defaults:

cipher AES-256-CBC
tls-cipher 'HIGH:!SHA:!MD5:!AES128'

cipher AES-256-CBC
tls-cipher 'DEFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA'

Example for client config addition:

cipher AES-256-CBC

Then restart server's openvpn service.
Then restart the client's openvpn service.

Any different errors produced in the logs with these explicit entries?

Pippin

Bug in OpenSSL?
https://github.com/openssl/openssl/issues/1799

TinCanTech

built against OpenSSL-1.1.0b

Openvpn only supports OpenSSL-1.0.1x at this time .. so probably not a candidate.