VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo L

daemontools

Good day, today the provider JustLan (Russia) began to block OpenVPN, when connected to any configuration, it displays the following error:

Sat Mar 21 10:22:09 2020 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Sat Mar 21 10:22:09 2020 Windows version 6.1 (Windows 7) 64bit
Sat Mar 21 10:22:09 2020 library versions: OpenSSL 1.1.0l 10 Sep 2019, LZO 2.10
Sat Mar 21 10:22:09 2020 MANAGEMENT: TCP Socket listening on [AF_INET] 127.0.0.1:25340
Sat Mar 21 10:22:09 2020 Need hold release from management interface, waiting ...
Sat Mar 21 10:22:10 2020 MANAGEMENT: Client connected from [AF_INET] 127.0.0.1:25340
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'state on'
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'log all on'
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'echo all on'
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'bytecount 5'
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'hold off'
Sat Mar 21 10:22:10 2020 MANAGEMENT: CMD 'hold release'
Sat Mar 21 10:22:10 2020 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Mar 21 10:22:10 2020 MANAGEMENT:> STATE: 1584775330, RESOLVE ,,,,,,
Sat Mar 21 10:22:10 2020 TCP / UDP: Preserving recently used remote address: [AF_INET] 186.123.174.219:1195
Sat Mar 21 10:22:10 2020 Socket Buffers: R = [8192-> 8192] S = [8192-> 8192]
Sat Mar 21 10:22:10 2020 UDP link local: (not bound)
Sat Mar 21 10:22:10 2020 UDP link remote: [AF_INET] 186.123.174.219:1195
Sat Mar 21 10:22:10 2020 MANAGEMENT:> STATE: 1584775330, WAIT ,,,,,,
Sat Mar 21 10:22:10 2020 MANAGEMENT:> STATE: 1584775330, AUTH ,,,,,,
Sat Mar 21 10:22:10 2020 TLS: Initial packet from [AF_INET] 186.123.174.219:1195, sid = 6f0ab442 bc5e6755
Sat Mar 21 10:22:11 2020 VERIFY ERROR: depth = 1, error = unable to get local issuer certificate: C = GB, ST = Greater 11 2020 OpenSSL: error: 1416F086: SSL routines: tls_process_server_certificate: certificate verify failed
Sat Mar 21 10:22:11 2020 TLS_ERROR: BIO read tls_read_plaintext error
Sat Mar 21 10:22:11 2020 TLS Error: TLS object -> incoming plaintext read error
Sat Mar 21 10:22:11 2020 TLS Error: TLS handshake failed
Sat Mar 21 10:22:11 2020 SIGUSR1 [soft, tls-error] received, process restarting
Sat Mar 21 10:22:11 2020 MANAGEMENT:> STATE: 1584775331, RECONNECTING, tls-error ,,,,,
Sat Mar 21 10:22:11 2020 Restart pause, 5 second (s)
[code]
There is a similar situation with android. I checked on Win10, Win7, and androids phones. How can I get around this?

mickelroy

I also have same issue

2020-03-21 17:46:24 official build 0.7.15 running on Verizon SM-G935V (msm8996), Android 8.0.0 (R16NW) API 26, ABI arm64-v8a, (Verizon/hero2qltevzw/hero2qltevzw:8.0.0/R16NW/G935VVRS9CSB1:user/release-keys)
2020-03-21 17:46:24 MANAGEMENT: >STATE:1584837984,AUTH,,,,,,
2020-03-21 17:46:24 TLS: Initial packet from [AF_INET]69.132.140.26:1588, sid=068bee8d a511722e
2020-03-21 17:46:25 VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
2020-03-21 17:46:25 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-03-21 17:46:25 Waiting 2s seconds between connection attempt
2020-03-21 17:46:25 TLS_ERROR: BIO read tls_read_plaintext error
2020-03-21 17:46:25 TLS Error: TLS object -> incoming plaintext read error
2020-03-21 17:46:25 TLS Error: TLS handshake failed
2020-03-21 17:46:25 Fatal TLS error (check_tls_errors_co), restarting
2020-03-21 17:46:25 TCP/UDP: Closing socket
2020-03-21 17:46:25 SIGUSR1[soft,tls-error] received, process restarting
2020-03-21 17:46:25 MANAGEMENT: >STATE:1584837985,RECONNECTING,tls-error,,,,,
2020-03-21 17:46:27 MANAGEMENT: CMD 'hold release'
2020-03-21 17:46:27 MANAGEMENT: CMD 'proxy NONE'
2020-03-21 17:46:27 MANAGEMENT: CMD 'bytecount 2'
2020-03-21 17:46:27 MANAGEMENT: CMD 'state on'
2020-03-21 17:46:28 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2020-03-21 17:46:28 Control Channel MTU parms [ L:1623 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2020-03-21 17:46:28 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
2020-03-21 17:46:28 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2020-03-21 17:46:28 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2020-03-21 17:46:28 TCP/UDP: Preserving recently used remote address: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:28 Socket Buffers: R=[6294156->6294156] S=[1048576->1048576]
2020-03-21 17:46:28 Attempting to establish TCP connection with [AF_INET]69.132.140.26:1588 [nonblock]
2020-03-21 17:46:28 MANAGEMENT: >STATE:1584837988,TCP_CONNECT,,,,,,
2020-03-21 17:46:28 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:29 TCP connection established with [AF_INET]69.132.140.26:1588
2020-03-21 17:46:29 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:29 TCP_CLIENT link local: (not bound)
2020-03-21 17:46:29 TCP_CLIENT link remote: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:29 MANAGEMENT: >STATE:1584837989,WAIT,,,,,,
2020-03-21 17:46:29 MANAGEMENT: >STATE:1584837989,AUTH,,,,,,
2020-03-21 17:46:29 TLS: Initial packet from [AF_INET]69.132.140.26:1588, sid=304d04d4 4a926e44
2020-03-21 17:46:30 VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
2020-03-21 17:46:30 Waiting 2s seconds between connection attempt
2020-03-21 17:46:30 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-03-21 17:46:30 TLS_ERROR: BIO read tls_read_plaintext error
2020-03-21 17:46:30 TLS Error: TLS object -> incoming plaintext read error
2020-03-21 17:46:30 TLS Error: TLS handshake failed
2020-03-21 17:46:30 Fatal TLS error (check_tls_errors_co), restarting
2020-03-21 17:46:30 TCP/UDP: Closing socket
2020-03-21 17:46:30 SIGUSR1[soft,tls-error] received, process restarting
2020-03-21 17:46:30 MANAGEMENT: >STATE:1584837990,RECONNECTING,tls-error,,,,,
2020-03-21 17:46:32 MANAGEMENT: CMD 'hold release'
2020-03-21 17:46:32 MANAGEMENT: CMD 'bytecount 2'
2020-03-21 17:46:32 MANAGEMENT: CMD 'proxy NONE'
2020-03-21 17:46:32 MANAGEMENT: CMD 'state on'
2020-03-21 17:46:33 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2020-03-21 17:46:33 Control Channel MTU parms [ L:1623 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2020-03-21 17:46:33 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
2020-03-21 17:46:33 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2020-03-21 17:46:33 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2020-03-21 17:46:33 TCP/UDP: Preserving recently used remote address: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:33 Socket Buffers: R=[6294156->6294156] S=[1048576->1048576]
2020-03-21 17:46:33 Attempting to establish TCP connection with [AF_INET]69.132.140.26:1588 [nonblock]
2020-03-21 17:46:33 MANAGEMENT: >STATE:1584837993,TCP_CONNECT,,,,,,
2020-03-21 17:46:33 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:34 TCP connection established with [AF_INET]69.132.140.26:1588
2020-03-21 17:46:34 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:34 TCP_CLIENT link local: (not bound)
2020-03-21 17:46:34 TCP_CLIENT link remote: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:34 MANAGEMENT: >STATE:1584837994,WAIT,,,,,,
2020-03-21 17:46:34 MANAGEMENT: >STATE:1584837994,AUTH,,,,,,
2020-03-21 17:46:34 TLS: Initial packet from [AF_INET]69.132.140.26:1588, sid=507bb059 0cdf0130
2020-03-21 17:46:35 VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
2020-03-21 17:46:35 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-03-21 17:46:35 TLS_ERROR: BIO read tls_read_plaintext error
2020-03-21 17:46:35 Waiting 2s seconds between connection attempt
2020-03-21 17:46:35 TLS Error: TLS object -> incoming plaintext read error
2020-03-21 17:46:35 TLS Error: TLS handshake failed
2020-03-21 17:46:35 Fatal TLS error (check_tls_errors_co), restarting
2020-03-21 17:46:35 TCP/UDP: Closing socket
2020-03-21 17:46:35 SIGUSR1[soft,tls-error] received, process restarting
2020-03-21 17:46:35 MANAGEMENT: >STATE:1584837995,RECONNECTING,tls-error,,,,,
2020-03-21 17:46:37 MANAGEMENT: CMD 'hold release'
2020-03-21 17:46:37 MANAGEMENT: CMD 'proxy NONE'
2020-03-21 17:46:37 MANAGEMENT: CMD 'bytecount 2'
2020-03-21 17:46:37 MANAGEMENT: CMD 'state on'
2020-03-21 17:46:38 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2020-03-21 17:46:38 Control Channel MTU parms [ L:1623 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2020-03-21 17:46:38 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
2020-03-21 17:46:38 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2020-03-21 17:46:38 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2020-03-21 17:46:38 TCP/UDP: Preserving recently used remote address: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:38 Socket Buffers: R=[6294156->6294156] S=[1048576->1048576]
2020-03-21 17:46:38 Attempting to establish TCP connection with [AF_INET]69.132.140.26:1588 [nonblock]
2020-03-21 17:46:38 MANAGEMENT: >STATE:1584837998,TCP_CONNECT,,,,,,
2020-03-21 17:46:38 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:39 TCP connection established with [AF_INET]69.132.140.26:1588
2020-03-21 17:46:39 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:39 TCP_CLIENT link local: (not bound)
2020-03-21 17:46:39 TCP_CLIENT link remote: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:39 MANAGEMENT: >STATE:1584837999,WAIT,,,,,,
2020-03-21 17:46:40 MANAGEMENT: >STATE:1584838000,AUTH,,,,,,
2020-03-21 17:46:40 TLS: Initial packet from [AF_INET]69.132.140.26:1588, sid=2badea1d 66535bcb
2020-03-21 17:46:41 VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
2020-03-21 17:46:41 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-03-21 17:46:41 TLS_ERROR: BIO read tls_read_plaintext error
2020-03-21 17:46:41 TLS Error: TLS object -> incoming plaintext read error
2020-03-21 17:46:41 TLS Error: TLS handshake failed
2020-03-21 17:46:41 Fatal TLS error (check_tls_errors_co), restarting
2020-03-21 17:46:41 TCP/UDP: Closing socket
2020-03-21 17:46:41 SIGUSR1[soft,tls-error] received, process restarting
2020-03-21 17:46:41 MANAGEMENT: >STATE:1584838001,RECONNECTING,tls-error,,,,,
2020-03-21 17:46:41 Waiting 2s seconds between connection attempt
2020-03-21 17:46:43 MANAGEMENT: CMD 'hold release'
2020-03-21 17:46:43 MANAGEMENT: CMD 'proxy NONE'
2020-03-21 17:46:43 MANAGEMENT: CMD 'bytecount 2'
2020-03-21 17:46:43 MANAGEMENT: CMD 'state on'
2020-03-21 17:46:44 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2020-03-21 17:46:44 Control Channel MTU parms [ L:1623 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2020-03-21 17:46:44 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
2020-03-21 17:46:44 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2020-03-21 17:46:44 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2020-03-21 17:46:44 TCP/UDP: Preserving recently used remote address: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:44 Socket Buffers: R=[6294156->6294156] S=[1048576->1048576]
2020-03-21 17:46:44 Attempting to establish TCP connection with [AF_INET]69.132.140.26:1588 [nonblock]
2020-03-21 17:46:44 MANAGEMENT: >STATE:1584838004,TCP_CONNECT,,,,,,
2020-03-21 17:46:44 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:45 TCP connection established with [AF_INET]69.132.140.26:1588
2020-03-21 17:46:45 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2020-03-21 17:46:45 TCP_CLIENT link local: (not bound)
2020-03-21 17:46:45 TCP_CLIENT link remote: [AF_INET]69.132.140.26:1588
2020-03-21 17:46:45 MANAGEMENT: >STATE:1584838005,WAIT,,,,,,
2020-03-21 17:46:45 MANAGEMENT: >STATE:1584838005,AUTH,,,,,,
2020-03-21 17:46:45 TLS: Initial packet from [AF_INET]69.132.140.26:1588, sid=9248fe82 d0163482

TinCanTech

This is because:

mickelroy wrote C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain (IN)Validation (IN)Secure Server CA (of CrapolA)

Sectigo are a bunch of cowboys ..

This has nothing what-so-ever to do with OpenVPN.