All -
Hoping to resolve an issue where Linux Clients successfully connect to an OpenVPN Server (CentOS 8) however Windows Clients fail with the ubiquitous error:
Wed Jul 15 17:26:29 2020 VERIFY ERROR: depth=0, error=unable to get local issuer certificate:
Server-side O/S and OpenVPN Version Information:
[root@openvpnserver server]# uname -a
Linux openvpnserver 4.18.0-147.8.1.el8_1.x86_64
[root@openvpnserver server]# openvpn --version
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS 28 May 2019, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
...
proto udp4
port 42424
dev tun
server 10.200.0.0 255.255.255.248
topology subnet
persist-key
persist-tun
keepalive 10 60
ccd-exclusive
remote-cert-tls client
client-config-dir /etc/openvpn/clients
tls-auth /etc/openvpn/server/ta.key 0
dh /etc/openvpn/server/dh.param
pkcs12 /etc/openvpn/server/server.p12
auth SHA512
user nobody
group nobody
verb 4
daemon
log-append /var/log/openvpn.log
status /var/run/openvpn.status 3
push "route 192.168.13.0 255.255.255.0"
ncp-disable
cipher AES-256-GCM
Here is the Server-Side Level 4 Log Data when a Client attempts a connection:
[root@openvpnserver server]# systemctl restart openvpn-server@server
[root@openvpnserver server]# tail -f /var/log/openvpn.log
/sbin/ip addr add dev tun0 10.200.0.1/29 broadcast 10.200.0.7
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:42424
UDPv4 link remote: [AF_UNSPEC]
GID set to nobody
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.200.0.2 size=4, ipv6=0
Initialization Sequence Completed
MULTI: multi_create_instance called
XXX.XXX.XXX.XXX:53927 Re-using SSL/TLS context
XXX.XXX.XXX.XXX:53927 Control Channel MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ]
XXX.XXX.XXX.XXX:53927 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
XXX.XXX.XXX.XXX:53927 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
XXX.XXX.XXX.XXX:53927 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
XXX.XXX.XXX.XXX:53927 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:53927, sid=0393cfcb cf9a69c5
MULTI: multi_create_instance called
XXX.XXX.XXX.XXX:53928 Re-using SSL/TLS context
XXX.XXX.XXX.XXX:53928 Control Channel MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ]
XXX.XXX.XXX.XXX:53928 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
XXX.XXX.XXX.XXX:53928 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
XXX.XXX.XXX.XXX:53928 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
XXX.XXX.XXX.XXX:53928 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:53928, sid=23cd0507 d88d8b87
And now for the Client Data.
C:\Program Files\OpenVPN\bin>ver
Microsoft Windows [Version 10.0.18362.900]
C:\Program Files\OpenVPN\bin>openvpn.exe --version
OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Windows version 6.2 (Windows 8 or greater) 64bit
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=no enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=yes enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_special_build= with_sysroot=no
client
proto udp4
remote XXX.XXX.XXX.XXX
port XXXXX
dev tun
nobind
remote-cert-tls server
tls-auth "C:\\Program Files\\OpenVPN\\client\\ta.key" 1
auth SHA512
pkcs12 "C:\\Program Files\\OpenVPN\\client\\client1.p12"
ncp-disable
cipher AES-256-GCM
explicit-exit-notify 3
The associated Client-side log:
Wed Jul 15 17:26:29 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Wed Jul 15 17:26:29 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Jul 15 17:26:29 2020 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Enter Management Password:
Wed Jul 15 17:26:29 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.XXX.XXX.XXX:XXXXX
Wed Jul 15 17:26:29 2020 UDPv4 link local: (not bound)
Wed Jul 15 17:26:29 2020 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:XXXXX
Wed Jul 15 17:26:29 2020 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=DS, ST=DF, O=asdfasdf, OU=asdfas, CN=server
Wed Jul 15 17:26:29 2020 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wed Jul 15 17:26:29 2020 TLS_ERROR: BIO read tls_read_plaintext error
Wed Jul 15 17:26:29 2020 TLS Error: TLS object -> incoming plaintext read error
Wed Jul 15 17:26:29 2020 TLS Error: TLS handshake failed
Wed Jul 15 17:26:29 2020 SIGUSR1[soft,tls-error] received, process restarting
Wed Jul 15 17:26:31 2020 SIGTERM[hard,init_instance] received, process exiting
Again, we don't quite understand why Linux Clients successfully connect whereas Windows Clients fail.
I really would appreciate any guidance or advice the community can provide.
Thanks in advance.
