Base OS: CentOS 6.x
I tried to update my openvpn server from 2.3.x to 2.4.1
At the same time I noted that openssl updated from
openssl.x86_64 0:1.0.1e-48.el6 to openssl.x86_64 0:1.0.1e-57.el6
After a reboot I got a number of errors in the logs and could no longer connect from any client.
I first downgraded openvpn to the 2.3.x version but the errors continued. In desperation I downgraded openssl (as I have multiple clients and did not expect an upgrade to totally trash the system when I haven't the time to fully sort it out)
That fixed it, and immediately all clients could connect again.
I am not sure where the issue lies. There are a mountain of similar reports but I can't see a straight forward answer.
Anyone got any ideas ? Some seemed to suggest I might need to regenerate all my certs but that seems a bit extreme?
B. Rgds
John
SERVER LOG (had reverted to working version before I could do verb 4)
Fri Apr 21 22:52:00 2017 us=550427 my.ip.addr:54716 Re-using SSL/TLS context
Fri Apr 21 22:52:00 2017 us=550524 my.ip.addr:54716 LZO compression initialized
Fri Apr 21 22:52:00 2017 us=550553 my.ip.addr:54716 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1460)
Fri Apr 21 22:52:00 2017 us=550731 my.ip.addr:54716 Control Channel MTU parms [ L:1518 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Fri Apr 21 22:52:00 2017 us=550768 my.ip.addr:54716 Data Channel MTU parms [ L:1518 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Fri Apr 21 22:52:00 2017 us=550854 my.ip.addr:54716 Local Options String: 'V4,dev-type tun,link-mtu 1518,tun-mtu 1460,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Fri Apr 21 22:52:00 2017 us=550887 my.ip.addr:54716 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1518,tun-mtu 1460,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Fri Apr 21 22:52:00 2017 us=550931 my.ip.addr:54716 Local Options hash (VER=V4): '0f0c9828'
Fri Apr 21 22:52:00 2017 us=550969 my.ip.addr:54716 Expected Remote Options hash (VER=V4): '1ba45294'
Fri Apr 21 22:52:00 2017 us=551055 my.ip.addr:54716 TLS: Initial packet from [AF_INET]my.ip.addr:54716, sid=1e91117f 06305ba5
Fri Apr 21 22:52:01 2017 us=803981 my.ip.addr:54716 CRL CHECK OK: C=xx, ST=xxx, L=xxxx, O=xxxx, emailAddress=
Fri Apr 21 22:52:01 2017 us=804109 my.ip.addr:54716 VERIFY OK: depth=1, C=xx, ST=xxx, L=xxxx, O=xxxx, emailAddress=
Fri Apr 21 22:52:01 2017 us=804188 my.ip.addr:54716 VERIFY ERROR: depth=0, error=certificate signature failure: C=xx, ST=xxx, L=xxxx, O=xxxx, OU=xxxx, CN=router, emailAddress=
Fri Apr 21 22:52:01 2017 us=804277 my.ip.addr:54716 OpenSSL: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Fri Apr 21 22:52:01 2017 us=804295 my.ip.addr:54716 TLS_ERROR: BIO read tls_read_plaintext error
Fri Apr 21 22:52:01 2017 us=804308 my.ip.addr:54716 TLS Error: TLS object -> incoming plaintext read error
Fri Apr 21 22:52:01 2017 us=804319 my.ip.addr:54716 TLS Error: TLS handshake failed
Fri Apr 21 22:52:01 2017 us=804382 my.ip.addr:54716 SIGUSR1[soft,tls-error] received, client-instance restarting
SERVER CONFIG:
port 1194
proto udp
dev tun0
ca keys/SRV/ca.crt
cert keys/SRV/SRV-svr.crt
key keys/SRV/SRV-svr.key
dh keys/SRV/dh2048.pem
server 192.168.90.0 255.255.255.0
crl-verify keys/SRV/crl.pem
cipher AES-256-CBC
user nobody
group nobody
status servers/SVR/logs/openvpn-status.log
log-append servers/SVR/logs/openvpn.log
verb 4
mute 20
max-clients 20
tun-mtu 1460
management 127.0.0.1 8876
keepalive 30 120
client-config-dir /etc/openvpn/servers/SVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "dhcp-option DNS 192.168.90.1"
push "route 192.168.90.0 255.255.255.0"
push "redirect-gateway def1"
CLIENT CONFIG:
client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert android.crt
key android.key
remote my.ip.addr 1194
cipher AES-256-CBC
user nobody
group nobody
verb 2
mute 20
keepalive 1800 3600
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
