Hello.
I have a problem connecting to a server (any server) using OpenVPN.
An example log from one of the servers I tried to connect to:
Sat Mar 21 20:02:01 2020 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Mar 21 20:02:01 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xxx.xx.xxx:1803
Sat Mar 21 20:02:01 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Mar 21 20:02:01 2020 UDP link local: (not bound)
Sat Mar 21 20:02:01 2020 UDP link remote: [AF_INET]xx.xxx.xx.xxx:1803
Sat Mar 21 20:02:01 2020 MANAGEMENT: >STATE:1584788521,WAIT,,,,,,
Sat Mar 21 20:02:02 2020 MANAGEMENT: >STATE:1584788522,AUTH,,,,,,
Sat Mar 21 20:02:02 2020 TLS: Initial packet from [AF_INET]xx.xxx.xx.xxx:1803, sid=d99609d2 c698d6e8
Sat Mar 21 20:02:02 2020 VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
Sat Mar 21 20:02:02 2020 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Sat Mar 21 20:02:02 2020 TLS_ERROR: BIO read tls_read_plaintext error
Sat Mar 21 20:02:02 2020 TLS Error: TLS object -> incoming plaintext read error
Sat Mar 21 20:02:02 2020 TLS Error: TLS handshake failed
Sat Mar 21 20:02:02 2020 SIGUSR1[soft,tls-error] received, process restarting
Sat Mar 21 20:02:02 2020 MANAGEMENT: >STATE:1584788522,RECONNECTING,tls-error,,,,,
Sat Mar 21 20:02:02 2020 Restart pause, 5 second(s)
# OpenVPN 2.0 Sample Configuration File
# for PacketiX VPN / SoftEther VPN Server
#
# !!! AUTO-GENERATED BY SOFTETHER VPN SERVER MANAGEMENT TOOL !!!
#
# !!! YOU HAVE TO REVIEW IT BEFORE USE AND MODIFY IT AS NECESSARY !!!
#
# This configuration file is auto-generated. You might use this config file
# in order to connect to the PacketiX VPN / SoftEther VPN Server.
# However, before you try it, you should review the descriptions of the file
# to determine the necessity to modify to suitable for your real environment.
# If necessary, you have to modify a little adequately on the file.
# For example, the IP address or the hostname as a destination VPN Server
# should be confirmed.
#
# Note that to use OpenVPN 2.0, you have to put the certification file of
# the destination VPN Server on the OpenVPN Client computer when you use this
# config file. Please refer the below descriptions carefully.
###############################################################################
# Specify the type of the layer of the VPN connection.
#
# To connect to the VPN Server as a "Remote-Access VPN Client PC",
# specify 'dev tun'. (Layer-3 IP Routing Mode)
#
# To connect to the VPN Server as a bridging equipment of "Site-to-Site VPN",
# specify 'dev tap'. (Layer-2 Ethernet Bridgine Mode)
dev tun
###############################################################################
# Specify the underlying protocol beyond the Internet.
# Note that this setting must be correspond with the listening setting on
# the VPN Server.
#
# Specify either 'proto tcp' or 'proto udp'.
proto udp
###############################################################################
# The destination hostname / IP address, and port number of
# the target VPN Server.
#
# You have to specify as 'remote <HOSTNAME> <PORT>'. You can also
# specify the IP address instead of the hostname.
#
# Note that the auto-generated below hostname are a "auto-detected
# IP address" of the VPN Server. You have to confirm the correctness
# beforehand.
#
# When you want to connect to the VPN Server by using TCP protocol,
# the port number of the destination TCP port should be same as one of
# the available TCP listeners on the VPN Server.
#
# When you use UDP protocol, the port number must same as the configuration
# setting of "OpenVPN Server Compatible Function" on the VPN Server.
remote xx.xxx.xx.xxx 1803
###############################################################################
# The HTTP/HTTPS proxy setting.
#
# Only if you have to use the Internet via a proxy, uncomment the below
# two lines and specify the proxy address and the port number.
# In the case of using proxy-authentication, refer the OpenVPN manual.
;http-proxy-retry
;http-proxy [proxy server] [proxy port]
###############################################################################
# The encryption and authentication algorithm.
#
# Default setting is good. Modify it as you prefer.
# When you specify an unsupported algorithm, the error will occur.
#
# The supported algorithms are as follows:
# cipher: [NULL-CIPHER] NULL AES-128-CBC AES-192-CBC AES-256-CBC BF-CBC
# CAST-CBC CAST5-CBC DES-CBC DES-EDE-CBC DES-EDE3-CBC DESX-CBC
# RC2-40-CBC RC2-64-CBC RC2-CBC
# auth: SHA SHA1 MD5 MD4 RMD160
cipher AES-128-CBC
auth SHA1
###############################################################################
# Other parameters necessary to connect to the VPN Server.
#
# It is not recommended to modify it unless you have a particular need.
resolv-retry infinite
nobind
persist-key
persist-tun
client
verb 3
#auth-user-pass
###############################################################################
# The certificate file of the destination VPN Server.
#
# The CA certificate file is embedded in the inline format.
# You can replace this CA contents if necessary.
# Please note that if the server certificate is not a self-signed, you have to
# specify the signer's root certificate (CA) here.
<ca>
-----BEGIN CERTIFICATE-----
MIIFxxx
-----END CERTIFICATE-----
</ca>
# The client certificate file (dummy).
#
# In some implementations of OpenVPN Client software
# (for example: OpenVPN Client for iOS),
# a pair of client certificate and private key must be included on the
# configuration file due to the limitation of the client.
# So this sample configuration file has a dummy pair of client certificate
# and private key as follows.
<cert>
-----BEGIN CERTIFICATE-----
MIICxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
MIIExxx
-----END RSA PRIVATE KEY-----
</key>
This started to happen this morning today and it happened suddenly.
Hours or even days before this happened, I could connect to any server using config files obtained from VPN gate.
This is the first time it happened and I've been spending the whole day trying to figure out what happened.
I'm a user using OpenVPN 2.4.8.
Prior to this issue, I did not do anything to change anything, be it my OpenVPN client setting, config file or even modifying any part of my network or internet settings.
If I use SoftEther, I can connect to the server without problem after I create a connection setting using attributes such as IP address from the config file.
But suddenly, started today in the morning, OpenVPN could not connect to any server and always showed this red error messages:
VERIFY ERROR: depth=1, error=unable to get local issuer certificate: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
TLS_ERROR: BIO read tls_read_plaintext error
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
I could not find help from any source about this issue.
Would anybody mind helping me to solve this issue?
