Hi,
I was setting up a new OpenVPN Server with Ubuntu 20.04 last weekend. I created everything I need from a tutorial. When I try to connect my client I am getting an error.
2021-01-26 04:29:45 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-01-26 04:29:45 OpenVPN 2.5.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 28 2020
2021-01-26 04:29:45 Windows version 10.0 (Windows 10 or greater) 64bit
2021-01-26 04:29:45 library versions: OpenSSL 1.1.1h 22 Sep 2020, LZO 2.10
Enter Management Password:
2021-01-26 04:29:45 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-01-26 04:29:45 Need hold release from management interface, waiting...
2021-01-26 04:29:46 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-01-26 04:29:46 MANAGEMENT: CMD 'state on'
2021-01-26 04:29:46 MANAGEMENT: CMD 'log all on'
2021-01-26 04:29:46 MANAGEMENT: CMD 'echo all on'
2021-01-26 04:29:46 MANAGEMENT: CMD 'bytecount 5'
2021-01-26 04:29:46 MANAGEMENT: CMD 'hold off'
2021-01-26 04:29:46 MANAGEMENT: CMD 'hold release'
2021-01-26 04:29:46 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-01-26 04:29:46 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-01-26 04:29:46 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-01-26 04:29:46 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-01-26 04:29:46 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xxx.xx.xxx:1194
2021-01-26 04:29:46 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-01-26 04:29:46 UDPv4 link local: (not bound)
2021-01-26 04:29:46 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
2021-01-26 04:29:46 MANAGEMENT: >STATE:1611631786,WAIT,,,,,,
2021-01-26 04:29:46 MANAGEMENT: >STATE:1611631786,AUTH,,,,,,
2021-01-26 04:29:46 TLS: Initial packet from [AF_INET]xx.xxx.xx.xxx:1194, sid=1cfc02b0 6eb603be
2021-01-26 04:29:46 VERIFY KU OK
2021-01-26 04:29:46 Validating certificate extended key usage
2021-01-26 04:29:46 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-01-26 04:29:46 VERIFY EKU OK
2021-01-26 04:29:46 VERIFY X509NAME ERROR: C=DE, ST=Baden, L=Mannheim, O=KPSGMBH, OU=IT-VPN, CN=server, emailAddress=it@kpsgmbh.com, must be server
2021-01-26 04:29:46 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2021-01-26 04:29:46 TLS_ERROR: BIO read tls_read_plaintext error
2021-01-26 04:29:46 TLS Error: TLS object -> incoming plaintext read error
2021-01-26 04:29:46 TLS Error: TLS handshake failed
2021-01-26 04:29:46 SIGUSR1[soft,tls-error] received, process restarting
2021-01-26 04:29:46 MANAGEMENT: >STATE:1611631786,RECONNECTING,tls-error,,,,,
2021-01-26 04:29:46 Restart pause, 5 second(s)
My client config:
fragment 1200
auth-nocache
auth SHA512
verify-x509-name server
client
dev tun
proto udp4
remote xx.xxx.xx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert andresommer.crt
key andresommer.key
remote-cert-tls server
tls-crypt ta.key
cipher AES-256-CBC
verb 3
My server config
fragment 1200
remote-cert-tls client
port 1194
proto udp4
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
tls-crypt ta.key # This file is secret
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1
My client files:
- andresommer.crt
andresommer.key
ca.crt
client.ovpn
ta.key
My server files which are kept in /etc/openvpn
- ca.crt
dh.pem
server.conf
server.crt
server.key
ta.key
Did I oversee a mistake? I was trying to do so many things, but it is not working. :cry:
I really hope someone can help me. Thanks in advance.
