Problem client Archlinux

noideal

Hi guys. I have an open server, it works fine with linux and windows clients, but there are several clients on arhlinux and with the exact same config they do not work.

I tried different directives and it did not lead to anybody. I give an example of a configuration, help me please.

server.conf(openvpn 2.4.0):

#Порт для подключения, стандартный 1194, но вы можете выбрать тот который больше нравится
port 1194
#Тип соединения TCP или UDP
proto udp
#Тин тоннеля
dev tun
#Список сертификатов
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
# При подключении мы будем попадать в эту сеть
server 10.100.10.0 255.255.255.0
#Сохраняем выдаенные адреса клиентов в файл
ifconfig-pool-persist ipp.txt
#Проверяем состояние канала
keepalive 20 120
#использовать сжатие
comp-lzo
persist-key
persist-tun
#включаем логирование
status openvpn-status.log
#уровень логирования
verb 5
#Определяем наш OpenVPN сервер в качестве шлюза по умолчанию
#push "redirect-gateway"
#Разрешаем соединения между клиентами
client-to-client
#добавляем маршруты к сети клиента(чтобы сервер видел сеть клиента)

route 192.168.100.0 255.255.255.0 10.100.10.1
route 192.168.31.0 255.255.255.0 10.100.10.1


#Маршрут для доступа к сети за сервером OpenVPN
push "route 192.168.88.0 255.255.255.0"
#Указываем DNS сервер
#push "dhcp-option DNS 8.8.8.8"
#привязка IP к логину
client-config-dir ccd
#user nobody
#group nobody
# Записывать статус сервера OpenVPN
status /var/log/openvpn/openvpn-status.log
# Логи
log /var/log/openvpn/openvpn.log

# Включаем TLS
tls-server
tls-auth ta.key 0
#!tls-timeout 120
#!auth SHA512
#!cipher BF-CBC

The client who works for Debian

client
dev tun
proto udp
remote xxxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert raspberrypi.crt
key raspberrypi.key
tls-auth ta.key 1
dh dh1024.pem
comp-lzo
verb 5

Client that does not work, client version 2.4.5-1

client
dev tun
proto udp
remote xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert thinkpad.crt
key thinkpad.key
#tls-client
tls-auth ta.key 1
#remote-cert-tls server
#dh dh1024.pem
#compress lzo
comp-lzo
verb 9

Loaded: loaded (/usr/lib/systemd/system/openvpn-client@.service; disabled; vendor preset: disabled)
Active: active (running) since Wed 2018-04-25 16:41:07 UTC; 10s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 32414 (openvpn)
Status: "Pre-connection initialization successful"
Tasks: 1 (limit: 4360)
Memory: 2.0M
CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@blacksrv.service
└─32414 /usr/bin/openvpn —suppress-timestamps —nobind —config blacksrv.conf

апр 25 16:41:17 thinkpad openvpn[32414]: TLS: tls_session_init: entry
апр 25 16:41:17 thinkpad openvpn[32414]: PID packet_id_init seq_backtrack=64 time_backtrack=15
апр 25 16:41:17 thinkpad openvpn[32414]: TLS: tls_session_init: new session object, sid=ec64bb9a 69b254f1
апр 25 16:41:17 thinkpad openvpn[32414]: TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=1438f206 d6502cdb, stored-sid=00000000 00000000, stored-ip=[AF_UNSP>
апр 25 16:41:17 thinkpad openvpn[32414]: TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
апр 25 16:41:17 thinkpad openvpn[32414]: PID packet_id_free
апр 25 16:41:17 thinkpad openvpn[32414]: TCP/UDP: Closing socket
апр 25 16:41:17 thinkpad openvpn[32414]: PID packet_id_free
апр 25 16:41:17 thinkpad openvpn[32414]: SIGUSR1[soft,tls-error] received, process restarting
апр 25 16:41:17 thinkpad openvpn[32414]: Restart pause, 5 second(s)

TinCanTech

Set --verb 4 in your arch client config and run it directly:

root@arch /etc/openvpn # openvpn arch-client.conf

and post the log output.

noideal

CLIENT LOG (--verb 4):

Wed Apr 25 23:31:17 2018 us=591607 WARNING: Ignoring option 'dh' in tls-client mode, please only include this in your server configuration
Wed Apr 25 23:31:17 2018 us=591719 WARNING: file 'thinkpad.key' is group or others accessible
Wed Apr 25 23:31:17 2018 us=591747 WARNING: file 'ta.key' is group or others accessible
Wed Apr 25 23:31:17 2018 us=591771 Current Parameter Settings:
Wed Apr 25 23:31:17 2018 us=591790   config = 'blacksrv.conf'
Wed Apr 25 23:31:17 2018 us=591809   mode = 0
Wed Apr 25 23:31:17 2018 us=591836   persist_config = DISABLED
Wed Apr 25 23:31:17 2018 us=591860   persist_mode = 1
Wed Apr 25 23:31:17 2018 us=591879   show_ciphers = DISABLED
Wed Apr 25 23:31:17 2018 us=591897   show_digests = DISABLED
Wed Apr 25 23:31:17 2018 us=591915   show_engines = DISABLED
Wed Apr 25 23:31:17 2018 us=591934   genkey = DISABLED
Wed Apr 25 23:31:17 2018 us=591952   key_pass_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=591970   show_tls_ciphers = DISABLED
Wed Apr 25 23:31:17 2018 us=591988   connect_retry_max = 0
Wed Apr 25 23:31:17 2018 us=592011 Connection profiles [0]:
Wed Apr 25 23:31:17 2018 us=592030   proto = udp
Wed Apr 25 23:31:17 2018 us=592049   local = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592067   local_port = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592085   remote = 'blackserver.32it.ru'
Wed Apr 25 23:31:17 2018 us=592103   remote_port = '1194'
Wed Apr 25 23:31:17 2018 us=592121   remote_float = DISABLED
Wed Apr 25 23:31:17 2018 us=592142   bind_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=592161   bind_local = DISABLED
Wed Apr 25 23:31:17 2018 us=592192   bind_ipv6_only = DISABLED
Wed Apr 25 23:31:17 2018 us=592212   connect_retry_seconds = 5
Wed Apr 25 23:31:17 2018 us=592232   connect_timeout = 120
Wed Apr 25 23:31:17 2018 us=592251   socks_proxy_server = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592270   socks_proxy_port = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592296   tun_mtu = 1500
Wed Apr 25 23:31:17 2018 us=592314   tun_mtu_defined = ENABLED
Wed Apr 25 23:31:17 2018 us=592332   link_mtu = 1500
Wed Apr 25 23:31:17 2018 us=592355   link_mtu_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=592373   tun_mtu_extra = 0
Wed Apr 25 23:31:17 2018 us=592392   tun_mtu_extra_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=592409   mtu_discover_type = -1
Wed Apr 25 23:31:17 2018 us=592427   fragment = 0
Wed Apr 25 23:31:17 2018 us=592445   mssfix = 1450
Wed Apr 25 23:31:17 2018 us=592463   explicit_exit_notification = 0
Wed Apr 25 23:31:17 2018 us=592481 Connection profiles END
Wed Apr 25 23:31:17 2018 us=592499   remote_random = DISABLED
Wed Apr 25 23:31:17 2018 us=592522   ipchange = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592540   dev = 'tun'
Wed Apr 25 23:31:17 2018 us=592559   dev_type = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592576   dev_node = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592595   lladdr = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592612   topology = 1
Wed Apr 25 23:31:17 2018 us=592630   ifconfig_local = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592648   ifconfig_remote_netmask = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592666   ifconfig_noexec = DISABLED
Wed Apr 25 23:31:17 2018 us=592689   ifconfig_nowarn = DISABLED
Wed Apr 25 23:31:17 2018 us=592708   ifconfig_ipv6_local = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592726   ifconfig_ipv6_netbits = 0
Wed Apr 25 23:31:17 2018 us=592744   ifconfig_ipv6_remote = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=592762   shaper = 0
Wed Apr 25 23:31:17 2018 us=592780   mtu_test = 0
Wed Apr 25 23:31:17 2018 us=592798   mlock = DISABLED
Wed Apr 25 23:31:17 2018 us=592823   keepalive_ping = 0
Wed Apr 25 23:31:17 2018 us=592847   keepalive_timeout = 0
Wed Apr 25 23:31:17 2018 us=592866   inactivity_timeout = 0
Wed Apr 25 23:31:17 2018 us=592884   ping_send_timeout = 0
Wed Apr 25 23:31:17 2018 us=592902   ping_rec_timeout = 0
Wed Apr 25 23:31:17 2018 us=592920   ping_rec_timeout_action = 0
Wed Apr 25 23:31:17 2018 us=592938   ping_timer_remote = DISABLED
Wed Apr 25 23:31:17 2018 us=592956   remap_sigusr1 = 0
Wed Apr 25 23:31:17 2018 us=592974   persist_tun = ENABLED
Wed Apr 25 23:31:17 2018 us=592991   persist_local_ip = DISABLED
Wed Apr 25 23:31:17 2018 us=593017   persist_remote_ip = DISABLED
Wed Apr 25 23:31:17 2018 us=593037   persist_key = ENABLED
Wed Apr 25 23:31:17 2018 us=593054   passtos = DISABLED
Wed Apr 25 23:31:17 2018 us=593072   resolve_retry_seconds = 1000000000
Wed Apr 25 23:31:17 2018 us=593090   resolve_in_advance = DISABLED
Wed Apr 25 23:31:17 2018 us=593108   username = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593135   groupname = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593154   chroot_dir = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593182   cd_dir = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593203   writepid = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593223   up_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593243   down_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593262   down_pre = DISABLED
Wed Apr 25 23:31:17 2018 us=593282   up_restart = DISABLED
Wed Apr 25 23:31:17 2018 us=593302   up_delay = DISABLED
Wed Apr 25 23:31:17 2018 us=593323   daemon = DISABLED
Wed Apr 25 23:31:17 2018 us=593344   inetd = 0
Wed Apr 25 23:31:17 2018 us=593372   log = DISABLED
Wed Apr 25 23:31:17 2018 us=593402   suppress_timestamps = DISABLED
Wed Apr 25 23:31:17 2018 us=593421   machine_readable_output = DISABLED
Wed Apr 25 23:31:17 2018 us=593441   nice = 0
Wed Apr 25 23:31:17 2018 us=593461   verbosity = 4
Wed Apr 25 23:31:17 2018 us=593480   mute = 0
Wed Apr 25 23:31:17 2018 us=593498   gremlin = 0
Wed Apr 25 23:31:17 2018 us=593518   status_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593538   status_file_version = 1
Wed Apr 25 23:31:17 2018 us=593575   status_file_update_freq = 60
Wed Apr 25 23:31:17 2018 us=593598   occ = ENABLED
Wed Apr 25 23:31:17 2018 us=593622   rcvbuf = 0
Wed Apr 25 23:31:17 2018 us=593645   sndbuf = 0
Wed Apr 25 23:31:17 2018 us=593669   mark = 0
Wed Apr 25 23:31:17 2018 us=593693   sockflags = 0
Wed Apr 25 23:31:17 2018 us=593716   fast_io = DISABLED
Wed Apr 25 23:31:17 2018 us=593740   comp.alg = 2
Wed Apr 25 23:31:17 2018 us=593761   comp.flags = 1
Wed Apr 25 23:31:17 2018 us=593783   route_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593829   route_default_gateway = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=593853   route_default_metric = 0
Wed Apr 25 23:31:17 2018 us=593874   route_noexec = DISABLED
Wed Apr 25 23:31:17 2018 us=593895   route_delay = 0
Wed Apr 25 23:31:17 2018 us=593915   route_delay_window = 30
Wed Apr 25 23:31:17 2018 us=593935   route_delay_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=593955   route_nopull = DISABLED
Wed Apr 25 23:31:17 2018 us=593975   route_gateway_via_dhcp = DISABLED
Wed Apr 25 23:31:17 2018 us=594002   allow_pull_fqdn = DISABLED
Wed Apr 25 23:31:17 2018 us=594022   management_addr = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594042   management_port = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594062   management_user_pass = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594082   management_log_history_cache = 250
Wed Apr 25 23:31:17 2018 us=594102   management_echo_buffer_size = 100
Wed Apr 25 23:31:17 2018 us=594121   management_write_peer_info_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594148   management_client_user = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594169   management_client_group = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594188   management_flags = 0
Wed Apr 25 23:31:17 2018 us=594208   shared_secret_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594228   key_direction = 1
Wed Apr 25 23:31:17 2018 us=594249   ciphername = 'BF-CBC'
Wed Apr 25 23:31:17 2018 us=594269   ncp_enabled = ENABLED
Wed Apr 25 23:31:17 2018 us=594288   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Wed Apr 25 23:31:17 2018 us=594315   authname = 'SHA1'
Wed Apr 25 23:31:17 2018 us=594335   prng_hash = 'SHA1'
Wed Apr 25 23:31:17 2018 us=594355   prng_nonce_secret_len = 16
Wed Apr 25 23:31:17 2018 us=594376   keysize = 0
Wed Apr 25 23:31:17 2018 us=594396   engine = DISABLED
Wed Apr 25 23:31:17 2018 us=594416   replay = ENABLED
Wed Apr 25 23:31:17 2018 us=594436   mute_replay_warnings = DISABLED
Wed Apr 25 23:31:17 2018 us=594456   replay_window = 64
Wed Apr 25 23:31:17 2018 us=594476   replay_time = 15
Wed Apr 25 23:31:17 2018 us=594505   packet_id_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594526   use_iv = ENABLED
Wed Apr 25 23:31:17 2018 us=594546   test_crypto = DISABLED
Wed Apr 25 23:31:17 2018 us=594565   tls_server = DISABLED
Wed Apr 25 23:31:17 2018 us=594585   tls_client = ENABLED
Wed Apr 25 23:31:17 2018 us=594604   key_method = 2
Wed Apr 25 23:31:17 2018 us=594624   ca_file = 'ca.crt'
Wed Apr 25 23:31:17 2018 us=594644   ca_path = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594664   dh_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594692   cert_file = 'thinkpad.crt'
Wed Apr 25 23:31:17 2018 us=594714   extra_certs_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594734   priv_key_file = 'thinkpad.key'
Wed Apr 25 23:31:17 2018 us=594754   pkcs12_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594774   cipher_list = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594795   tls_cert_profile = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594835   tls_verify = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594858   tls_export_cert = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594886   verify_x509_type = 0
Wed Apr 25 23:31:17 2018 us=594906   verify_x509_name = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594926   crl_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=594946   ns_cert_type = 0
Wed Apr 25 23:31:17 2018 us=594966   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=594986   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595006   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595027   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595047   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595075   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595097   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595116   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595137   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595156   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595176   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595196   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595217   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595244   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595265   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595285   remote_cert_ku[i] = 0
Wed Apr 25 23:31:17 2018 us=595305   remote_cert_eku = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=595326   ssl_flags = 0
Wed Apr 25 23:31:17 2018 us=595346   tls_timeout = 2
Wed Apr 25 23:31:17 2018 us=595366   renegotiate_bytes = -1
Wed Apr 25 23:31:17 2018 us=595385   renegotiate_packets = 0
Wed Apr 25 23:31:17 2018 us=595407   renegotiate_seconds = 3600
Wed Apr 25 23:31:17 2018 us=595434   handshake_window = 60
Wed Apr 25 23:31:17 2018 us=595454   transition_window = 3600
Wed Apr 25 23:31:17 2018 us=595474   single_session = DISABLED
Wed Apr 25 23:31:17 2018 us=595495   push_peer_info = DISABLED
Wed Apr 25 23:31:17 2018 us=595515   tls_exit = DISABLED
Wed Apr 25 23:31:17 2018 us=595534   tls_auth_file = 'ta.key'
Wed Apr 25 23:31:17 2018 us=595554   tls_crypt_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=595574   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595601   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595622   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595641   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595660   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595681   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595701   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595721   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595749   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595770   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595791   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595829   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595852   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595873   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595902   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595923   pkcs11_protected_authentication = DISABLED
Wed Apr 25 23:31:17 2018 us=595944   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=595965   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=595985   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596005   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596025   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596054   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596076   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596096   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596116   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596136   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596156   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596176   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596196   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596225   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596246   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596266   pkcs11_private_mode = 00000000
Wed Apr 25 23:31:17 2018 us=596287   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596307   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596327   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596347   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596376   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596398   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596417   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596437   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596458   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596478   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596498   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596517   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596546   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596567   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596586   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596607   pkcs11_cert_private = DISABLED
Wed Apr 25 23:31:17 2018 us=596627   pkcs11_pin_cache_period = -1
Wed Apr 25 23:31:17 2018 us=596647   pkcs11_id = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=596666   pkcs11_id_management = DISABLED
Wed Apr 25 23:31:17 2018 us=596695   server_network = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596718   server_netmask = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596750   server_network_ipv6 = ::
Wed Apr 25 23:31:17 2018 us=596771   server_netbits_ipv6 = 0
Wed Apr 25 23:31:17 2018 us=596792   server_bridge_ip = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596826   server_bridge_netmask = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596848   server_bridge_pool_start = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596869   server_bridge_pool_end = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596897   ifconfig_pool_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=596919   ifconfig_pool_start = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596941   ifconfig_pool_end = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596962   ifconfig_pool_netmask = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=596981   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597001   ifconfig_pool_persist_refresh_freq = 600
Wed Apr 25 23:31:17 2018 us=597021   ifconfig_ipv6_pool_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=597050   ifconfig_ipv6_pool_base = ::
Wed Apr 25 23:31:17 2018 us=597072   ifconfig_ipv6_pool_netbits = 0
Wed Apr 25 23:31:17 2018 us=597093   n_bcast_buf = 256
Wed Apr 25 23:31:17 2018 us=597113   tcp_queue_limit = 64
Wed Apr 25 23:31:17 2018 us=597133   real_hash_size = 256
Wed Apr 25 23:31:17 2018 us=597153   virtual_hash_size = 256
Wed Apr 25 23:31:17 2018 us=597173   client_connect_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597193   learn_address_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597222   client_disconnect_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597243   client_config_dir = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597263   ccd_exclusive = DISABLED
Wed Apr 25 23:31:17 2018 us=597283   tmp_dir = '/tmp'
Wed Apr 25 23:31:17 2018 us=597303   push_ifconfig_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=597324   push_ifconfig_local = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=597345   push_ifconfig_remote_netmask = 0.0.0.0
Wed Apr 25 23:31:17 2018 us=597365   push_ifconfig_ipv6_defined = DISABLED
Wed Apr 25 23:31:17 2018 us=597395   push_ifconfig_ipv6_local = ::/0
Wed Apr 25 23:31:17 2018 us=597417   push_ifconfig_ipv6_remote = ::
Wed Apr 25 23:31:17 2018 us=597436   enable_c2c = DISABLED
Wed Apr 25 23:31:17 2018 us=597456   duplicate_cn = DISABLED
Wed Apr 25 23:31:17 2018 us=597477   cf_max = 0
Wed Apr 25 23:31:17 2018 us=597497   cf_per = 0
Wed Apr 25 23:31:17 2018 us=597518   max_clients = 1024
Wed Apr 25 23:31:17 2018 us=597538   max_routes_per_client = 256
Wed Apr 25 23:31:17 2018 us=597558   auth_user_pass_verify_script = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597587   auth_user_pass_verify_script_via_file = DISABLED
Wed Apr 25 23:31:17 2018 us=597608   auth_token_generate = DISABLED
Wed Apr 25 23:31:17 2018 us=597628   auth_token_lifetime = 0
Wed Apr 25 23:31:17 2018 us=597648   port_share_host = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597667   port_share_port = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597687   client = ENABLED
Wed Apr 25 23:31:17 2018 us=597708   pull = ENABLED
Wed Apr 25 23:31:17 2018 us=597737   auth_user_pass_file = '[UNDEF]'
Wed Apr 25 23:31:17 2018 us=597759 OpenVPN 2.4.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Mar  1 2018
Wed Apr 25 23:31:17 2018 us=597793 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Wed Apr 25 23:31:17 2018 us=597925 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Apr 25 23:31:17 2018 us=598676 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 25 23:31:17 2018 us=598742 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 25 23:31:17 2018 us=598769 LZO compression initializing
Wed Apr 25 23:31:17 2018 us=598894 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Wed Apr 25 23:31:17 2018 us=891472 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Wed Apr 25 23:31:17 2018 us=891626 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed Apr 25 23:31:17 2018 us=891705 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed Apr 25 23:31:17 2018 us=891755 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:17 2018 us=891883 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Apr 25 23:31:17 2018 us=891936 UDP link local: (not bound)
Wed Apr 25 23:31:17 2018 us=891975 UDP link remote: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:18 2018 us=31534 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=11164b38 4be65968
Wed Apr 25 23:31:20 2018 us=523270 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=RU, ST=32, L=Bryansk, O=XXXXXXVPN, CN=XXXXXXVPN CA, emailAddress=XXXXXX88@gmail.com
Wed Apr 25 23:31:20 2018 us=523513 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wed Apr 25 23:31:20 2018 us=523600 TLS_ERROR: BIO read tls_read_plaintext error
Wed Apr 25 23:31:20 2018 us=523660 TLS Error: TLS object -> incoming plaintext read error
Wed Apr 25 23:31:20 2018 us=523712 TLS Error: TLS handshake failed
Wed Apr 25 23:31:20 2018 us=524155 TCP/UDP: Closing socket
Wed Apr 25 23:31:20 2018 us=524303 SIGUSR1[soft,tls-error] received, process restarting
Wed Apr 25 23:31:20 2018 us=524430 Restart pause, 5 second(s)
Wed Apr 25 23:31:25 2018 us=524602 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Apr 25 23:31:25 2018 us=524751 Re-using SSL/TLS context
Wed Apr 25 23:31:25 2018 us=524808 LZO compression initializing
Wed Apr 25 23:31:25 2018 us=524989 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Wed Apr 25 23:31:25 2018 us=680036 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Wed Apr 25 23:31:25 2018 us=680265 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed Apr 25 23:31:25 2018 us=680342 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed Apr 25 23:31:25 2018 us=680442 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:25 2018 us=680533 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Apr 25 23:31:25 2018 us=680594 UDP link local: (not bound)
Wed Apr 25 23:31:25 2018 us=680653 UDP link remote: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:25 2018 us=695781 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=43ad6e52 82ba0e88
Wed Apr 25 23:31:25 2018 us=715567 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=RU, ST=32, L=Bryansk, O=XXXXXXVPN, CN=XXXXXXVPN CA, emailAddress=XXXXXX88@gmail.com
Wed Apr 25 23:31:25 2018 us=715693 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wed Apr 25 23:31:25 2018 us=715732 TLS_ERROR: BIO read tls_read_plaintext error
Wed Apr 25 23:31:25 2018 us=715757 TLS Error: TLS object -> incoming plaintext read error
Wed Apr 25 23:31:25 2018 us=715780 TLS Error: TLS handshake failed
Wed Apr 25 23:31:25 2018 us=715910 TCP/UDP: Closing socket
Wed Apr 25 23:31:25 2018 us=715956 SIGUSR1[soft,tls-error] received, process restarting
Wed Apr 25 23:31:25 2018 us=715989 Restart pause, 5 second(s)
Wed Apr 25 23:31:30 2018 us=716142 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Apr 25 23:31:30 2018 us=716336 Re-using SSL/TLS context
Wed Apr 25 23:31:30 2018 us=716436 LZO compression initializing
Wed Apr 25 23:31:30 2018 us=716589 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Wed Apr 25 23:31:30 2018 us=874909 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Wed Apr 25 23:31:30 2018 us=875127 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed Apr 25 23:31:30 2018 us=875160 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed Apr 25 23:31:30 2018 us=875234 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:30 2018 us=875276 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Apr 25 23:31:30 2018 us=875305 UDP link local: (not bound)
Wed Apr 25 23:31:30 2018 us=875331 UDP link remote: [AF_INET]88.88.88.88:1194
Wed Apr 25 23:31:30 2018 us=956240 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=d3a529c9 3ee7db78
Wed Apr 25 23:31:31 2018 us=61217 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=RU, ST=32, L=Bryansk, O=XXXXXXVPN, CN=XXXXXXVPN CA, emailAddress=XXXXXX88@gmail.com
Wed Apr 25 23:31:31 2018 us=61401 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wed Apr 25 23:31:31 2018 us=61455 TLS_ERROR: BIO read tls_read_plaintext error
Wed Apr 25 23:31:31 2018 us=61492 TLS Error: TLS object -> incoming plaintext read error
Wed Apr 25 23:31:31 2018 us=61559 TLS Error: TLS handshake failed
Wed Apr 25 23:31:31 2018 us=61785 TCP/UDP: Closing socket
Wed Apr 25 23:31:31 2018 us=61887 SIGUSR1[soft,tls-error] received, process restarting
Wed Apr 25 23:31:31 2018 us=61943 Restart pause, 5 second(s)
Wed Apr 25 23:31:32 2018 us=85203 SIGINT[hard,init_instance] received, process exiting

TinCanTech

noideal wrote Wed Apr 25 23:31:31 2018 us=61217 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=RU, ST=32, L=Bryansk, O=XXXXXXVPN, CN=XXXXXXVPN CA, emailAddress=XXXXXX88@gmail.com
Wed Apr 25 23:31:31 2018 us=61401 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

You have created this client certificate incorrectly.

noideal

Guys, you know the phrase stupid ass. So that's me.
I tried everything, but it turned out that the difference between ca.crt

I do not know how it happened, but diff it helped me.

Thank you very much for your help, I learned a lot from you.