I'm using Zerina-1.0.0-i586-beta04_445.1788 / OpenVPN v2.3.13 on smoothwall.
Now i have problem with ner Android road warrior to connect - here is the client's log (xxx replace private information):
20:19:54.965 -- ----- OpenVPN Start -----
20:19:54.967 -- EVENT: CORE_THREAD_ACTIVE
20:19:54.970 -- OpenVPN core 3.git::728733ae:Release android armv7a thumb2 32-bit PT_PROXY built on Aug 14 2019 14:13:59
20:19:54.995 -- Frame=512/2048/512 mssfix-ctrl=1250
20:19:54.996 -- UNUSED OPTIONS
0 [tls-client]
1 [pull]
3 [lport] [1194]
5 [explicit-exit-notify] [2]
8 [pkcs12] [xxxxxx.p12]
12 [verb] [3]
13 [mute] [20]
14 [persist-tun]
15 [persist-key]
20:19:54.997 -- EVENT: RESOLVE
20:19:55.003 -- Contacting xxxx.xxxx.xxxx.xxxx:1194 via UDP
20:19:55.003 -- EVENT: WAIT
20:19:55.009 -- Connecting to [xxxx.xxxx.xxxx.xxxx.]:1194 (xxxx.xxxx.xxxx.xxxx) via UDPv4
20:19:55.326 -- EVENT: CONNECTING
20:19:55.329 -- Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client
20:19:55.330 -- Creds: UsernameEmpty/PasswordEmpty
20:19:55.332 -- Peer Info:
IV_GUI_VER=OC30Android
IV_VER=3.git::728733ae:Release
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1
20:19:55.641 -- VERIFY FAIL -- The certificate is not correctly signed by the trusted CA : depth=0
cert. version : 3
serial number : 01
issuer name : C=NO, ST=xxxx, L=xxxx, O=xxxx, OU=xxxx, CN=xxxx CA, emailAddress=
xxxxx@xxxxx.xx
subject name : C=NO, ST=xxxx, O=xxxx, OU=xxxx, CN=xxxx.xxxx.xxxx.xxxx
issued on : 2019-10-27 16:23:40
expires on : 2038-03-18 16:23:40
signed using : RSA with SHA-256
RSA key size : 1024 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
20:19:55.643 -- Transport Error: mbed TLS: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
20:19:55.644 -- EVENT: CERT_VERIFY_FAIL info='mbed TLS: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed'
20:19:55.668 -- EVENT: CORE_THREAD_INACTIVE
20:19:55.670 -- Tunnel bytes per CPU second: 0
20:19:55.671 -- ----- OpenVPN Stop -----
Maybe I'm wrong but it seems to me that the problem is the RSA key size : 1024 bits where Android expects RSA key size : 2048 bits ? ?
In #OpenVPN common server conf i found dh /var/smoothwall/mods/zerina/ovpn/ca/dh1024.pem and I tried to change this setting to
dh /var/smoothwall/mods/zerina/ovpn/ca/dh2048.pem but now openvpn refuse to start
How to generate the dh2048.pem and where to finsd it after generation and move it to the correct location.
I assume that is the fis but maybe I'm still wrong ?
I tried from the terminal:
openssl dhparam -out dh2048.pem 2048
, it took a while but the process seemed to be sucessfull. where to find thie dh2048.pem ofter generation, and is the fcert the system needs ??
As you all understand I'm a newbie and need some help :-)
