OpenVPN can't read certificate from Windows certificate store

patrikr

Hi,

we have the issue, that OpenVPN not always is able to read the certificate from the Windows certificate store and as a matter of last ressort, we have to delete the Windows user profile from the device and add it again. Here are the details:

We use OpenVPN with 2 factor authentication. 1 factor is radius authentication and the second are certificates from the windows certificate store.

Measures which we try before deleting the windows user profile are reinstallation of OpenVPN, the certificate, TAP adapters, which most of the time helps. We also verify, that OpenVPN is started as administrator. Still there are some users left, where we have to delete the whole windows user profile. This is particulary a big problem for our developers.

Can you please have a look at it and come up with your comments?

Thanks.

Client systems: Windows 7 and 10, OpenVPN mixed versions
Server system: Oracle Linux 7.6 with kernel 4.1.12-124.14.1.el7uek.x86_64 and OpenVPN 2.4.6 x86_64-redhat-linux-gnu

#OpenVPN Server with Active Directory Radius Backend

#Network Settings
mode server
local x.x.x.x
proto tcp
port 443
dev tun1

#Radius Auth Settings
#plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
#plugin /usr/lib/openvpn/radiusplugin.so
plugin /etc/openvpn/radius/radiusplugin.so /etc/openvpn/radius/radius.cnf

#auth-nocache
reneg-sec 86400

#prevent client to client communication
client-to-client

#Cert Settings
tls-server
ca /etc/ssl/private/openvpn/server/x.cer
crl-verify /etc/openvpn/x.pem
cert /etc/ssl/private/openvpn/server/x.pem
key /etc/ssl/private/openvpn/server/x.pem
dh /etc/ssl/private/openvpn/server/dh4096.pem

#Crypto/Cipher Suite Settings
cipher AES-256-CBC
auth SHA512

# Performance settings
hash-size 4096 4096
sndbuf 0
rcvbuf 0
txqueuelen 200

persist-key
persist-tun

#Client Network Settings
server x.x.x.x 255.255.252.0

client-config-dir /etc/openvpn/clients/tcp_443/config_dir_tcp_443
persist-local-ip
persist-remote-ip

push "route x.x.x.x 255.255.0.0"
push "route x.x.x.x 255.255.0.0"
push "route x.x.x.x 255.255.255.0"
push "route x.x.x.x 255.255.0.0 net_gateway"
push "route x.x.x.x 255.255.0.0 net_gateway"

push "dhcp-option DNS x.x.x.x"
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DOMAIN x.at"
push "dhcp-option WINS x.x.x.x"
push "redirect-gateway"

#Connection Optimization
keepalive 10 600
comp-lzo adaptive

#Run OpenVPN Server as nobody
user nobody
group nogroup

#Enable Management Interface
management x.x.x.x 5558

#Logging
status /var/log/openvpn/x.stat
#automatic logging to syslog instead of:
#log-append /var/log/openvpn/x.log
verb 4

#KSI OpenVPN Roadwarrior with Radius Auth
#Client Settings
tls-client
client
dev tun

#Network Settings
proto tcp
tun-mtu 1500
remote-random
remote x.x.x.x 443
remote x.x.x.x 443

#Radius Auth Settings
auth-user-pass
fast-io
auth-nocache
script-security 2
reneg-sec 0
push-peer-info

#Connection Optimization
comp-lzo
keepalive 10 600

#Crypt
cipher AES-256-CBC
auth SHA512

# SSL
cryptoapicert "SUBJ:at, x, x_x, People"
remote-cert-tls server

<ca>
subject=/DC=at/DC=x/CN=x-x-x
issuer=/DC=at/DC=x/CN=x-x-x
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>

persist-key
persist-tun

verb 3

#Win Vista/7 Options
route-method exe
route-delay 2

Server Logfile:


Mar 26 11:07:52 servername-n1 openvpn: Tue Mar 26 11:07:52 2019 us=655505 TCP connection established with [AF_INET]x.x.x.x:28122
Mar 26 11:07:52 servername-n1 openvpn: Tue Mar 26 11:07:52 2019 us=655521 TCPv4_SERVER link local: (not bound)
Mar 26 11:07:52 servername-n1 openvpn: Tue Mar 26 11:07:52 2019 us=655537 TCPv4_SERVER link remote: [AF_INET]x.x.x.x:28122
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=625493 x.x.x.x:28122 TLS: Initial packet from [AF_INET]x.x.x.x:28122, sid=66918902 8dbbd1b6
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=882894 x.x.x.x:28122 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: DC=at, DC=x, OU=x_x, OU=People, OU=x, OU=Intern, CN=x
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=882982 x.x.x.x:28122 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883002 x.x.x.x:28122 TLS_ERROR: BIO read tls_read_plaintext error
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883017 x.x.x.x:28122 TLS Error: TLS object -> incoming plaintext read error
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883031 x.x.x.x:28122 TLS Error: TLS handshake failed
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883107 x.x.x.x:28122 Fatal TLS error (check_tls_errors_co), restarting
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883124 x.x.x.x:28122 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 26 11:07:53 servername-n1 openvpn: Tue Mar 26 11:07:53 2019 us=883174 TCP/UDP: Closing socket
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75668 MULTI: multi_create_instance called
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75766 Re-using SSL/TLS context
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75789 LZO compression initializing
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75873 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75898 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75940 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75955 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=75989 TCP connection established with [AF_INET]x.x.x.x:28123
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=76005 TCPv4_SERVER link local: (not bound)
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=76021 TCPv4_SERVER link remote: [AF_INET]x.x.x.x:28123
Mar 26 11:09:02 servername-n1 openvpn: Tue Mar 26 11:09:02 2019 us=975622 x.x.x.x:28123 TLS: Initial packet from [AF_INET]x.x.x.x:28123, sid=4897a22b d57c2474
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232575 x.x.x.x:28123 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: DC=at, DC=x, OU=x_x, OU=People, OU=x, OU=Intern, CN=x
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232665 x.x.x.x:28123 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232685 x.x.x.x:28123 TLS_ERROR: BIO read tls_read_plaintext error
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232699 x.x.x.x:28123 TLS Error: TLS object -> incoming plaintext read error
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232714 x.x.x.x:28123 TLS Error: TLS handshake failed
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232790 x.x.x.x:28123 Fatal TLS error (check_tls_errors_co), restarting
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232807 x.x.x.x:28123 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 26 11:09:03 servername-n1 openvpn: Tue Mar 26 11:09:03 2019 us=232854 TCP/UDP: Closing socket
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675477 MULTI: multi_create_instance called
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675563 Re-using SSL/TLS context
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675588 LZO compression initializing
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675671 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675698 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675738 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675755 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Mar 26 11:09:14 servername-n1 openvpn: Tue Mar 26 11:09:14 2019 us=675787 TCP connection established with [AF_INET]x.x.x.x:28124

Client logfile:

Tue Mar 26 11:08:46 2019 us=865424 Current Parameter Settings:
Tue Mar 26 11:08:46 2019 us=869434   config = 'x_TCP.OVPN'
Tue Mar 26 11:08:46 2019 us=869434   mode = 0
Tue Mar 26 11:08:46 2019 us=869434   show_ciphers = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   show_digests = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   show_engines = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   genkey = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   key_pass_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   show_tls_ciphers = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   connect_retry_max = 0
Tue Mar 26 11:08:46 2019 us=869434 Connection profiles [0]:
Tue Mar 26 11:08:46 2019 us=869434   proto = tcp-client
Tue Mar 26 11:08:46 2019 us=869434   local = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   local_port = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   remote = 'x.x.x.x'
Tue Mar 26 11:08:46 2019 us=869434   remote_port = '443'
Tue Mar 26 11:08:46 2019 us=869434   remote_float = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_local = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_ipv6_only = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   connect_retry_seconds = 5
Tue Mar 26 11:08:46 2019 us=869434   connect_timeout = 120
Tue Mar 26 11:08:46 2019 us=869434   socks_proxy_server = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   socks_proxy_port = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu = 1500
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_defined = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   link_mtu = 1500
Tue Mar 26 11:08:46 2019 us=869434   link_mtu_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_extra = 0
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_extra_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   mtu_discover_type = -1
Tue Mar 26 11:08:46 2019 us=869434   fragment = 0
Tue Mar 26 11:08:46 2019 us=869434   mssfix = 1450
Tue Mar 26 11:08:46 2019 us=869434   explicit_exit_notification = 0
Tue Mar 26 11:08:46 2019 us=869434 Connection profiles [1]:
Tue Mar 26 11:08:46 2019 us=869434   proto = tcp-client
Tue Mar 26 11:08:46 2019 us=869434   local = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   local_port = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   remote = 'x.x.x.x'
Tue Mar 26 11:08:46 2019 us=869434   remote_port = '443'
Tue Mar 26 11:08:46 2019 us=869434   remote_float = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_local = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   bind_ipv6_only = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   connect_retry_seconds = 5
Tue Mar 26 11:08:46 2019 us=869434   connect_timeout = 120
Tue Mar 26 11:08:46 2019 us=869434   socks_proxy_server = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   socks_proxy_port = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu = 1500
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_defined = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   link_mtu = 1500
Tue Mar 26 11:08:46 2019 us=869434   link_mtu_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_extra = 0
Tue Mar 26 11:08:46 2019 us=869434   tun_mtu_extra_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   mtu_discover_type = -1
Tue Mar 26 11:08:46 2019 us=869434   fragment = 0
Tue Mar 26 11:08:46 2019 us=869434   mssfix = 1450
Tue Mar 26 11:08:46 2019 us=869434   explicit_exit_notification = 0
Tue Mar 26 11:08:46 2019 us=869434 Connection profiles END
Tue Mar 26 11:08:46 2019 us=869434   remote_random = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   ipchange = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   dev = 'tun'
Tue Mar 26 11:08:46 2019 us=869434   dev_type = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   dev_node = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   lladdr = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   topology = 1
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_local = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_remote_netmask = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_noexec = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_nowarn = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_ipv6_local = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_ipv6_netbits = 0
Tue Mar 26 11:08:46 2019 us=869434   ifconfig_ipv6_remote = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   shaper = 0
Tue Mar 26 11:08:46 2019 us=869434   mtu_test = 0
Tue Mar 26 11:08:46 2019 us=869434   mlock = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   keepalive_ping = 10
Tue Mar 26 11:08:46 2019 us=869434   keepalive_timeout = 600
Tue Mar 26 11:08:46 2019 us=869434   inactivity_timeout = 0
Tue Mar 26 11:08:46 2019 us=869434   ping_send_timeout = 10
Tue Mar 26 11:08:46 2019 us=869434   ping_rec_timeout = 600
Tue Mar 26 11:08:46 2019 us=869434   ping_rec_timeout_action = 2
Tue Mar 26 11:08:46 2019 us=869434   ping_timer_remote = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   remap_sigusr1 = 0
Tue Mar 26 11:08:46 2019 us=869434   persist_tun = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   persist_local_ip = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   persist_remote_ip = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   persist_key = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   passtos = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   resolve_retry_seconds = 1000000000
Tue Mar 26 11:08:46 2019 us=869434   resolve_in_advance = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   username = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   groupname = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   chroot_dir = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   cd_dir = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   writepid = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   up_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   down_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   down_pre = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   up_restart = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   up_delay = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   daemon = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   inetd = 0
Tue Mar 26 11:08:46 2019 us=869434   log = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   suppress_timestamps = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   machine_readable_output = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   nice = 0
Tue Mar 26 11:08:46 2019 us=869434   verbosity = 4
Tue Mar 26 11:08:46 2019 us=869434   mute = 0
Tue Mar 26 11:08:46 2019 us=869434   gremlin = 0
Tue Mar 26 11:08:46 2019 us=869434   status_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   status_file_version = 1
Tue Mar 26 11:08:46 2019 us=869434   status_file_update_freq = 60
Tue Mar 26 11:08:46 2019 us=869434   occ = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   rcvbuf = 0
Tue Mar 26 11:08:46 2019 us=869434   sndbuf = 0
Tue Mar 26 11:08:46 2019 us=869434   sockflags = 0
Tue Mar 26 11:08:46 2019 us=869434   fast_io = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   comp.alg = 2
Tue Mar 26 11:08:46 2019 us=869434   comp.flags = 1
Tue Mar 26 11:08:46 2019 us=869434   route_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   route_default_gateway = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   route_default_metric = 0
Tue Mar 26 11:08:46 2019 us=869434   route_noexec = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   route_delay = 2
Tue Mar 26 11:08:46 2019 us=869434   route_delay_window = 30
Tue Mar 26 11:08:46 2019 us=869434   route_delay_defined = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   route_nopull = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   route_gateway_via_dhcp = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   allow_pull_fqdn = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   Pull filters:
Tue Mar 26 11:08:46 2019 us=869434     ignore "route-method"
Tue Mar 26 11:08:46 2019 us=869434   management_addr = '127.0.0.1'
Tue Mar 26 11:08:46 2019 us=869434   management_port = '25347'
Tue Mar 26 11:08:46 2019 us=869434   management_user_pass = 'stdin'
Tue Mar 26 11:08:46 2019 us=869434   management_log_history_cache = 250
Tue Mar 26 11:08:46 2019 us=869434   management_echo_buffer_size = 100
Tue Mar 26 11:08:46 2019 us=869434   management_write_peer_info_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   management_client_user = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   management_client_group = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   management_flags = 6
Tue Mar 26 11:08:46 2019 us=869434   shared_secret_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   key_direction = not set
Tue Mar 26 11:08:46 2019 us=869434   ciphername = 'AES-256-CBC'
Tue Mar 26 11:08:46 2019 us=869434   ncp_enabled = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Tue Mar 26 11:08:46 2019 us=869434   authname = 'SHA512'
Tue Mar 26 11:08:46 2019 us=869434   prng_hash = 'SHA1'
Tue Mar 26 11:08:46 2019 us=869434   prng_nonce_secret_len = 16
Tue Mar 26 11:08:46 2019 us=869434   keysize = 0
Tue Mar 26 11:08:46 2019 us=869434   engine = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   replay = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   mute_replay_warnings = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   replay_window = 64
Tue Mar 26 11:08:46 2019 us=869434   replay_time = 15
Tue Mar 26 11:08:46 2019 us=869434   packet_id_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   use_iv = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   test_crypto = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   tls_server = DISABLED
Tue Mar 26 11:08:46 2019 us=869434   tls_client = ENABLED
Tue Mar 26 11:08:46 2019 us=869434   key_method = 2
Tue Mar 26 11:08:46 2019 us=869434   ca_file = '[[INLINE]]'
Tue Mar 26 11:08:46 2019 us=869434   ca_path = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   dh_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   cert_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   extra_certs_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   priv_key_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   pkcs12_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   cryptoapi_cert = 'SUBJ:at, x, x_x, People'
Tue Mar 26 11:08:46 2019 us=869434   cipher_list = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   cipher_list_tls13 = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   tls_cert_profile = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   tls_verify = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   tls_export_cert = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   verify_x509_type = 0
Tue Mar 26 11:08:46 2019 us=869434   verify_x509_name = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   crl_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=869434   ns_cert_type = 0
Tue Mar 26 11:08:46 2019 us=869434   remote_cert_ku[i] = 65535
Tue Mar 26 11:08:46 2019 us=869434   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=869434   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=869434   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_ku[i] = 0
Tue Mar 26 11:08:46 2019 us=870437   remote_cert_eku = 'TLS Web Server Authentication'
Tue Mar 26 11:08:46 2019 us=870437   ssl_flags = 0
Tue Mar 26 11:08:46 2019 us=870437   tls_timeout = 2
Tue Mar 26 11:08:46 2019 us=870437   renegotiate_bytes = -1
Tue Mar 26 11:08:46 2019 us=870437   renegotiate_packets = 0
Tue Mar 26 11:08:46 2019 us=870437   renegotiate_seconds = 0
Tue Mar 26 11:08:46 2019 us=870437   handshake_window = 60
Tue Mar 26 11:08:46 2019 us=870437   transition_window = 3600
Tue Mar 26 11:08:46 2019 us=870437   single_session = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   push_peer_info = ENABLED
Tue Mar 26 11:08:46 2019 us=870437   tls_exit = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   tls_auth_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   tls_crypt_file = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_protected_authentication = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_private_mode = 00000000
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_cert_private = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_pin_cache_period = -1
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_id = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   pkcs11_id_management = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   server_network = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   server_netmask = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   server_network_ipv6 = ::
Tue Mar 26 11:08:46 2019 us=870437   server_netbits_ipv6 = 0
Tue Mar 26 11:08:46 2019 us=870437   server_bridge_ip = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   server_bridge_netmask = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   server_bridge_pool_start = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   server_bridge_pool_end = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_start = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_end = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_netmask = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_pool_persist_refresh_freq = 600
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_ipv6_pool_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_ipv6_pool_base = ::
Tue Mar 26 11:08:46 2019 us=870437   ifconfig_ipv6_pool_netbits = 0
Tue Mar 26 11:08:46 2019 us=870437   n_bcast_buf = 256
Tue Mar 26 11:08:46 2019 us=870437   tcp_queue_limit = 64
Tue Mar 26 11:08:46 2019 us=870437   real_hash_size = 256
Tue Mar 26 11:08:46 2019 us=870437   virtual_hash_size = 256
Tue Mar 26 11:08:46 2019 us=870437   client_connect_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   learn_address_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   client_disconnect_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   client_config_dir = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   ccd_exclusive = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   tmp_dir = 'C:\Users\user\AppData\Local\Temp\'
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_local = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_remote_netmask = 0.0.0.0
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_ipv6_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_ipv6_local = ::/0
Tue Mar 26 11:08:46 2019 us=870437   push_ifconfig_ipv6_remote = ::
Tue Mar 26 11:08:46 2019 us=870437   enable_c2c = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   duplicate_cn = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   cf_max = 0
Tue Mar 26 11:08:46 2019 us=870437   cf_per = 0
Tue Mar 26 11:08:46 2019 us=870437   max_clients = 1024
Tue Mar 26 11:08:46 2019 us=870437   max_routes_per_client = 256
Tue Mar 26 11:08:46 2019 us=870437   auth_user_pass_verify_script = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   auth_user_pass_verify_script_via_file = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   auth_token_generate = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   auth_token_lifetime = 0
Tue Mar 26 11:08:46 2019 us=870437   client = ENABLED
Tue Mar 26 11:08:46 2019 us=870437   pull = ENABLED
Tue Mar 26 11:08:46 2019 us=870437   auth_user_pass_file = 'stdin'
Tue Mar 26 11:08:46 2019 us=870437   show_net_up = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   route_method = 3
Tue Mar 26 11:08:46 2019 us=870437   block_outside_dns = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   ip_win32_defined = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   ip_win32_type = 3
Tue Mar 26 11:08:46 2019 us=870437   dhcp_masq_offset = 0
Tue Mar 26 11:08:46 2019 us=870437   dhcp_lease_time = 31536000
Tue Mar 26 11:08:46 2019 us=870437   tap_sleep = 0
Tue Mar 26 11:08:46 2019 us=870437   dhcp_options = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   dhcp_renew = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   dhcp_pre_release = DISABLED
Tue Mar 26 11:08:46 2019 us=870437   domain = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   netbios_scope = '[UNDEF]'
Tue Mar 26 11:08:46 2019 us=870437   netbios_node_type = 0
Tue Mar 26 11:08:46 2019 us=870437   disable_nbt = DISABLED
Tue Mar 26 11:08:46 2019 us=870437 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 21 2019
Tue Mar 26 11:08:46 2019 us=870437 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Mar 26 11:08:46 2019 us=870437 library versions: OpenSSL 1.1.0j  20 Nov 2018, LZO 2.10
Enter Management Password:
Tue Mar 26 11:08:46 2019 us=898513 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25347
Tue Mar 26 11:08:46 2019 us=898513 Need hold release from management interface, waiting...
Tue Mar 26 11:08:47 2019 us=249819 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25347
Tue Mar 26 11:08:47 2019 us=351219 MANAGEMENT: CMD 'state on'
Tue Mar 26 11:08:47 2019 us=351219 MANAGEMENT: CMD 'log all on'
Tue Mar 26 11:08:47 2019 us=499493 MANAGEMENT: CMD 'echo all on'
Tue Mar 26 11:08:47 2019 us=503669 MANAGEMENT: CMD 'bytecount 5'
Tue Mar 26 11:08:47 2019 us=504672 MANAGEMENT: CMD 'hold off'
Tue Mar 26 11:08:47 2019 us=505674 MANAGEMENT: CMD 'hold release'
Tue Mar 26 11:08:55 2019 us=566775 MANAGEMENT: CMD 'username "Auth" "user"'
Tue Mar 26 11:08:55 2019 us=575802 MANAGEMENT: CMD 'password [...]'
Tue Mar 26 11:08:55 2019 us=581824 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:08:55 2019 us=609688 LZO compression initializing
Tue Mar 26 11:08:55 2019 us=609688 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:08:55 2019 us=609688 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:08:55 2019 us=609688 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:08:55 2019 us=609688 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:08:55 2019 us=609688 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:08:55 2019 us=609688 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:08:55 2019 us=609688 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:08:55 2019 us=609688 MANAGEMENT: >STATE:1553594935,TCP_CONNECT,,,,,,
Tue Mar 26 11:08:56 2019 us=611482 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:08:56 2019 us=611482 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:08:56 2019 us=611482 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:08:56 2019 us=611482 MANAGEMENT: >STATE:1553594936,WAIT,,,,,,
Tue Mar 26 11:08:56 2019 us=646223 MANAGEMENT: >STATE:1553594936,AUTH,,,,,,
Tue Mar 26 11:08:56 2019 us=646223 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=e408e7a6 744ab76a
Tue Mar 26 11:08:56 2019 us=869073 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:08:56 2019 us=870075 VERIFY KU OK
Tue Mar 26 11:08:56 2019 us=870075 Validating certificate extended key usage
Tue Mar 26 11:08:56 2019 us=870075 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:08:56 2019 us=870075 VERIFY EKU OK
Tue Mar 26 11:08:56 2019 us=870075 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:08:56 2019 us=906173 Signing hash using CNG: data size = 64
Tue Mar 26 11:08:56 2019 us=954905 Connection reset, restarting [0]
Tue Mar 26 11:08:56 2019 us=954905 TCP/UDP: Closing socket
Tue Mar 26 11:08:56 2019 us=954905 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:08:56 2019 us=954905 MANAGEMENT: >STATE:1553594936,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:08:56 2019 us=954905 Restart pause, 5 second(s)
Tue Mar 26 11:09:01 2019 us=956627 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:09:01 2019 us=956627 Re-using SSL/TLS context
Tue Mar 26 11:09:01 2019 us=956627 LZO compression initializing
Tue Mar 26 11:09:01 2019 us=956627 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:09:01 2019 us=956627 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:09:01 2019 us=956627 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:09:01 2019 us=956627 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:09:01 2019 us=956627 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:01 2019 us=956627 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:09:01 2019 us=956627 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:09:01 2019 us=956627 MANAGEMENT: >STATE:1553594941,TCP_CONNECT,,,,,,
Tue Mar 26 11:09:02 2019 us=957032 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:02 2019 us=957032 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:09:02 2019 us=957032 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:02 2019 us=957032 MANAGEMENT: >STATE:1553594942,WAIT,,,,,,
Tue Mar 26 11:09:02 2019 us=998169 MANAGEMENT: >STATE:1553594942,AUTH,,,,,,
Tue Mar 26 11:09:02 2019 us=998169 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=68b0901e 9679ec39
Tue Mar 26 11:09:03 2019 us=179510 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:09:03 2019 us=180513 VERIFY KU OK
Tue Mar 26 11:09:03 2019 us=180513 Validating certificate extended key usage
Tue Mar 26 11:09:03 2019 us=180513 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:09:03 2019 us=180513 VERIFY EKU OK
Tue Mar 26 11:09:03 2019 us=180513 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:09:03 2019 us=214604 Signing hash using CNG: data size = 64
Tue Mar 26 11:09:03 2019 us=252094 Connection reset, restarting [0]
Tue Mar 26 11:09:03 2019 us=252094 TCP/UDP: Closing socket
Tue Mar 26 11:09:03 2019 us=252094 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:09:03 2019 us=252094 MANAGEMENT: >STATE:1553594943,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:09:03 2019 us=252094 Restart pause, 5 second(s)
Tue Mar 26 11:09:08 2019 us=254342 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:09:08 2019 us=254342 Re-using SSL/TLS context
Tue Mar 26 11:09:08 2019 us=254342 LZO compression initializing
Tue Mar 26 11:09:08 2019 us=254342 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:09:08 2019 us=254342 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:09:08 2019 us=254342 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:09:08 2019 us=254342 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:09:08 2019 us=254342 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:08 2019 us=254342 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:09:08 2019 us=254342 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:09:08 2019 us=254342 MANAGEMENT: >STATE:1553594948,TCP_CONNECT,,,,,,
Tue Mar 26 11:09:09 2019 us=255861 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:09 2019 us=255861 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:09:09 2019 us=255861 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:09 2019 us=255861 MANAGEMENT: >STATE:1553594949,WAIT,,,,,,
Tue Mar 26 11:09:09 2019 us=298006 MANAGEMENT: >STATE:1553594949,AUTH,,,,,,
Tue Mar 26 11:09:09 2019 us=298976 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=0e951d90 fd53d419
Tue Mar 26 11:09:09 2019 us=510122 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:09:09 2019 us=510122 VERIFY KU OK
Tue Mar 26 11:09:09 2019 us=510122 Validating certificate extended key usage
Tue Mar 26 11:09:09 2019 us=510122 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:09:09 2019 us=510122 VERIFY EKU OK
Tue Mar 26 11:09:09 2019 us=510122 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:09:09 2019 us=569288 Signing hash using CNG: data size = 64
Tue Mar 26 11:09:09 2019 us=620462 Connection reset, restarting [0]
Tue Mar 26 11:09:09 2019 us=621428 TCP/UDP: Closing socket
Tue Mar 26 11:09:09 2019 us=621428 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:09:09 2019 us=621428 MANAGEMENT: >STATE:1553594949,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:09:09 2019 us=621428 Restart pause, 5 second(s)
Tue Mar 26 11:09:14 2019 us=624271 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:09:14 2019 us=624271 Re-using SSL/TLS context
Tue Mar 26 11:09:14 2019 us=624271 LZO compression initializing
Tue Mar 26 11:09:14 2019 us=624271 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:09:14 2019 us=624271 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:09:14 2019 us=624271 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:09:14 2019 us=624271 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:09:14 2019 us=624271 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:14 2019 us=624271 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:09:14 2019 us=624271 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:09:14 2019 us=624271 MANAGEMENT: >STATE:1553594954,TCP_CONNECT,,,,,,
Tue Mar 26 11:09:15 2019 us=626223 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:15 2019 us=626223 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:09:15 2019 us=626223 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:15 2019 us=626223 MANAGEMENT: >STATE:1553594955,WAIT,,,,,,
Tue Mar 26 11:09:15 2019 us=666900 MANAGEMENT: >STATE:1553594955,AUTH,,,,,,
Tue Mar 26 11:09:15 2019 us=666900 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=958d1d61 d54c19c5
Tue Mar 26 11:09:15 2019 us=829520 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:09:15 2019 us=829520 VERIFY KU OK
Tue Mar 26 11:09:15 2019 us=829520 Validating certificate extended key usage
Tue Mar 26 11:09:15 2019 us=829520 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:09:15 2019 us=829520 VERIFY EKU OK
Tue Mar 26 11:09:15 2019 us=829520 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:09:15 2019 us=866253 Signing hash using CNG: data size = 64
Tue Mar 26 11:09:15 2019 us=903103 Connection reset, restarting [0]
Tue Mar 26 11:09:15 2019 us=903103 TCP/UDP: Closing socket
Tue Mar 26 11:09:15 2019 us=903103 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:09:15 2019 us=904085 MANAGEMENT: >STATE:1553594955,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:09:15 2019 us=904085 Restart pause, 5 second(s)
Tue Mar 26 11:09:20 2019 us=907355 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:09:20 2019 us=907355 Re-using SSL/TLS context
Tue Mar 26 11:09:20 2019 us=907355 LZO compression initializing
Tue Mar 26 11:09:20 2019 us=907355 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:09:20 2019 us=907355 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:09:20 2019 us=907355 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:09:20 2019 us=907355 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:09:20 2019 us=907355 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:20 2019 us=907355 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:09:20 2019 us=907355 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:09:20 2019 us=907355 MANAGEMENT: >STATE:1553594960,TCP_CONNECT,,,,,,
Tue Mar 26 11:09:21 2019 us=908704 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:21 2019 us=908704 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:09:21 2019 us=908704 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:21 2019 us=908704 MANAGEMENT: >STATE:1553594961,WAIT,,,,,,
Tue Mar 26 11:09:21 2019 us=949334 MANAGEMENT: >STATE:1553594961,AUTH,,,,,,
Tue Mar 26 11:09:21 2019 us=949334 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=c57e3e50 a3ed84cc
Tue Mar 26 11:09:22 2019 us=115491 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:09:22 2019 us=115491 VERIFY KU OK
Tue Mar 26 11:09:22 2019 us=115491 Validating certificate extended key usage
Tue Mar 26 11:09:22 2019 us=115491 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:09:22 2019 us=115491 VERIFY EKU OK
Tue Mar 26 11:09:22 2019 us=115491 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:09:22 2019 us=146660 Signing hash using CNG: data size = 64
Tue Mar 26 11:09:22 2019 us=194269 Connection reset, restarting [0]
Tue Mar 26 11:09:22 2019 us=194269 TCP/UDP: Closing socket
Tue Mar 26 11:09:22 2019 us=195272 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:09:22 2019 us=195272 MANAGEMENT: >STATE:1553594962,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:09:22 2019 us=195272 Restart pause, 5 second(s)
Tue Mar 26 11:09:27 2019 us=198655 NOTE: --fast-io is disabled since we are running on Windows
Tue Mar 26 11:09:27 2019 us=198655 Re-using SSL/TLS context
Tue Mar 26 11:09:27 2019 us=198655 LZO compression initializing
Tue Mar 26 11:09:27 2019 us=198655 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Mar 26 11:09:27 2019 us=198655 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Tue Mar 26 11:09:27 2019 us=198655 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Tue Mar 26 11:09:27 2019 us=198655 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1604,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Tue Mar 26 11:09:27 2019 us=198655 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:27 2019 us=198655 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 26 11:09:27 2019 us=198655 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue Mar 26 11:09:27 2019 us=198655 MANAGEMENT: >STATE:1553594967,TCP_CONNECT,,,,,,
Tue Mar 26 11:09:28 2019 us=200100 TCP connection established with [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:28 2019 us=200100 TCP_CLIENT link local: (not bound)
Tue Mar 26 11:09:28 2019 us=200100 TCP_CLIENT link remote: [AF_INET]x.x.x.x:443
Tue Mar 26 11:09:28 2019 us=200100 MANAGEMENT: >STATE:1553594968,WAIT,,,,,,
Tue Mar 26 11:09:28 2019 us=247226 MANAGEMENT: >STATE:1553594968,AUTH,,,,,,
Tue Mar 26 11:09:28 2019 us=247226 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=3c2f41c3 d209c66b
Tue Mar 26 11:09:28 2019 us=389736 VERIFY OK: depth=1, DC=at, DC=x, CN=x-AG-VPN2
Tue Mar 26 11:09:28 2019 us=389736 VERIFY KU OK
Tue Mar 26 11:09:28 2019 us=389736 Validating certificate extended key usage
Tue Mar 26 11:09:28 2019 us=389736 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 26 11:09:28 2019 us=389736 VERIFY EKU OK
Tue Mar 26 11:09:28 2019 us=389736 VERIFY OK: depth=0, C=AT, ST=state, L=locality, O=x x, CN=servername, emailAddress=x.network@x.com
Tue Mar 26 11:09:28 2019 us=426836 Signing hash using CNG: data size = 64
Tue Mar 26 11:09:28 2019 us=473628 Connection reset, restarting [0]
Tue Mar 26 11:09:28 2019 us=473628 TCP/UDP: Closing socket
Tue Mar 26 11:09:28 2019 us=473628 SIGUSR1[soft,connection-reset] received, process restarting
Tue Mar 26 11:09:28 2019 us=473628 MANAGEMENT: >STATE:1553594968,RECONNECTING,connection-reset,,,,,
Tue Mar 26 11:09:28 2019 us=473628 Restart pause, 5 second(s)

TinCanTech

You do not need to start openvpn as administrator.

Instead, use the Openvpn-GUI and Interactive-service.

patrikr

I do run OpenVPN 2.4.6 on Windows 10 and interactive service is started. From my readings I understand OpenVPN should use interactive service by default. Anyway if I don't start OpenVPN as administrator it isn't able to overwrite routes.

Is there something else I need to configure?

patrikr

Same result with OpenVPN 2.4.7 x86_64-w64-mingw32.

TinCanTech

patrikr wrote I do run OpenVPN 2.4.6 on Windows 10 and interactive service is started. From my readings I understand OpenVPN should use interactive service by default. Anyway if I don't start OpenVPN as administrator it isn't able to overwrite routes.

You are not using the interactive service .. your client must be logged in as admin ..

This may help:
https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New#gui-group

patrikr

I now tried adding the group to my system and adding my user to this group. My user is also local administrator. Anyway, routes are not overwritten if I start OpenVPN without administrator privileges.

Also one time I tried with "OpenVPN Administrators" group name and another time with "Openvpn Administrators", as I am not sure on the upper/lower case spelling, based from the article.

Dewayne

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

You make your computer less secure because you don't follow the OpenVPN instructions.