Im experiencing this error: [b]Error message: Peer certificate verification faulure.[/b] What does it mean? Anyone know how to fix it? Cheers.

Hello ctolvett, I am afraid you'll have to recheck your configuration. Usually with OpenVPN when certificates are implemented, the client verifies the identity of the server, and the server verifies the identity of the client. Depending on where you see this message, such verification failed for either the server or the client. So you should probably check your certificates and verification options again carefully. Kind regards, Johan

Thank you Johan. How do I check my certificates and verification options? It is somtehing that I do in OpenVPN, or is it something I check on windows?

Hi There, Depending on where you see this message. Can you confirm where such verification failed error occur? Was it on the server or the client side? [quote=ctolvett post_id=100468 time=1625064062 user_id=54118] Thank you Johan. How do I check my certificates and verification options? It is somtehing that I do in OpenVPN, or is it something I check on windows? [/quote] Regards, Crowley

[quote=openvpn_inc post_id=100472 time=1625071706 user_id=52935] Depending on where you see this message. Can you confirm where such verification failed error occur? Was it on the server or the client side? [/quote] Hello! It's on the client side. It ocurrs when I tried to connect from my windows laptot to the server.

I have the same issue. I'm afraid this is not related to my configurations since the profile works on V3.2.3.1851 and the error message pops up on V3.3.1.2222, which means the new version probably has some bugs. Changing/commenting the auth option will make it disappear but the connection still fails. I can reproduce this at any time (by installing those 2 versions). BTW, my cert was signed by SHA256WithECDSA. Please help investigate. Thanks.

Hello, Peer certificate verification failure means that the certificate offered by the other side cannot be verified. It is a common problem if mistakes have been made in setting up the certificate infrastructure. While it is technically possible there is a bug in 3.3.1, I highly doubt it - we test over a hundred different configurations and it all passed. More than likely there is something actually wrong with the certificates, or something changed in terms of security requirements that now fails these certificates. Since you can reproduce a difference between 3.2.3 and 3.3.1, this is something we should be able to reproduce here as well, if we have all the necessary information. I do believe though that along the way in the investigation we may end up finding a problem in your certificates. If you want us to pursue investigating this problem we'll need you to send us the information on how exactly you have set up your server including how you generated your certificates, and how exactly you have set up your client including all the configuration and how you generated the certificates. If we follow those exact steps and we are able to reproduce the problem here too, then we'll have a better idea of what we're dealing with and can then provide a solution either by solving a possible bug or by informing you of the underlying problem that prevents the system from working, and possible solutions. All this information should be provided only at https://openvpn.net/support as information can be exchanged there securely, instead of on this public forum. Kind regards, Johan

Thanks Johan! Before I provide more details at Support, I want to give some clues here: 1. The server is Azure Virtual Hub User VPN (Point-to-Site) and I can't get too many details. 2. My cert chain: sha384ECDSA/P384 (self-signed root) -> sha384ECDSA/P256 (intermediate) -> sha256ECDSA/P256 (endpoint). Except the path length constraint(0) on the intermediate cert, no more special setups.

I have exactly the same issue as wn80sr. I've set up an Azure Virtual Network Gateway with OpenVPN configuration. It works perfectly fine on my machine and two other mac's. Unfortunately, it doesn't work on 3 different Windows devices that I've set it up. I've figured out that I have installed older version of OpenVPN Connect 3.2.3 1851. All other users have installed newest version. On one of the clients machines (Windows) I've also installed an older generation of the OpenVPN Connect (v2.7.1), imported the same configuration file and it works without a problem. It's a pity, that I can't download an older version of the newer generation of OpenVPN Connect on the website.

[quote=openvpn_inc post_id=100437 time=1624982806 user_id=52935] Hello ctolvett, I am afraid you'll have to recheck your configuration. Usually with OpenVPN when certificates are implemented, the client verifies the identity of the server, and the server verifies the identity of the client. Depending on where you see this message, such verification failed for either the server or the client. So you should probably check your certificates and verification options again carefully. Kind regards, Johan [/quote] Hi, I am having the same issue as this. I am using the same config file on my phone and Windows 10 and it works fine on my iPhone but fails on Win10. I am getting the error: "peer certificate verification failure" I am running version 3.3.1 (2222) Any ideas? I am assuming its a bug with the windows app? Thanks Tom

Hello wn80sr, stysiok, and Tommy3268, I'd suggest reporting all the technical details to our support ticket system at https://openvpn.net/support An important thing for us to resolve such issues is the ability to reproduce the problem. Currently we are getting very limited information here in this ticket, and to get more information, we need to get some possibly sensitive logs and files in order to reproduce the problem here. If we can reproduce it, we can find the cause for it. It might be something wrong with the certificates, or something wrong in the OpenVPN 3 core. In any case, we need information to reproduce this. Then we can find the cause and address it. Kind regards, Johan

Error message: Peer certificate verification failure

Miminoux

Well, After some tries, I ended up uninstalling OpenVPN Connect and using OpenVPN GUI (Community client).
OpenVPN Connect didn't work with Azure Gateway VPN. Even version 3.2.3 which could connect but without any working communication.

Thank you guy anyway.
bye

Arf

+1.
Same error here for MacOS OpenVPN Connect Client 3.3.1 and current 3.3.3. Tunnelblick 3.8.7a connects fine.
I connect to a Synology NAS with OpenVPN Server running.

Hazz

Can we have an update from OpenVPN regarding this issue with OpenVPN Connect client?

snwtoy

Over 12000 views on this thread.

Same issue here, reproduceable with the same versions outlined above.

Is there an increase or change in certificate algorithm requirements which means a cert which works in previous versions is no longer strong enough in the latest version?

openvpn_inc

Hazz wrote Can we have an update from OpenVPN regarding this issue with OpenVPN Connect client?

Hi Hazz,

Sorry, no. It does seem that there is some issue for OpenVPN Connect and verification of certificates with either of these:

Azure Point-to-Site
Synology NAS

Presumably each of those are running some variation of Community edition OpenVPN server. We don't support and maintain those, so we don't have the ability to test this.

AFAIK no one in this thread has yet opened a support ticket with the details. We need that. We need logs, ideally from Connect client AND the server. If I am not correct, and someone here has opened a ticket, please reply with the ticket number, so I can look it up and reopen if necessary.

Please use the link in my signature to provide us the information to try to figure this out. I can also suggest for Azure and Synology users to open support tickets with those companies.

snwtoy wrote Over 12000 views on this thread.

Same issue here, reproduceable with the same versions outlined above.

Is there an increase or change in certificate algorithm requirements which means a cert which works in previous versions is no longer strong enough in the latest version?

That indeed sounds like a plausible guess. Perhaps if you could get us openssl(1) x509(1) information about the server, client and CA certificates, we could check on that. If you don't know how to do that, attach those certificates (and DO NOT attach private keys) to a Support ticket. Certificates are safe to post; they do not require secure handling.

regards, rob0

lightxx

In my case the problem was an expired self-signed certificate on the Synology side.
The cert expired on January 24th. I don't know if this cert gets shipped from Synology or if it is created upon installing DSM (hence I don't know if it expires for everybody on that date or just me). In either way, it is NOT renewed automatically.
I got exactly the same error message when the cert expired: "Peer certificate verification failure".

The workaround is pretty easy, create a new self-signed cert, restart the Synology VPN server, remove the old config profile from all your clients, download the config profile from the Synology VPN server, and push it to the clients. Solved my problem.

Hazz

openvpn_inc wrote
Hazz wrote Can we have an update from OpenVPN regarding this issue with OpenVPN Connect client?
Hi Hazz,

Sorry, no. It does seem that there is some issue for OpenVPN Connect and verification of certificates with either of these:
Azure Point-to-Site
Synology NAS
Presumably each of those are running some variation of Community edition OpenVPN server. We don't support and maintain those, so we don't have the ability to test this.

AFAIK no one in this thread has yet opened a support ticket with the details. We need that. We need logs, ideally from Connect client AND the server. If I am not correct, and someone here has opened a ticket, please reply with the ticket number, so I can look it up and reopen if necessary.

Please use the link in my signature to provide us the information to try to figure this out. I can also suggest for Azure and Synology users to open support tickets with those companies.

snwtoy wrote Over 12000 views on this thread.

Same issue here, reproduceable with the same versions outlined above.

Is there an increase or change in certificate algorithm requirements which means a cert which works in previous versions is no longer strong enough in the latest version?
That indeed sounds like a plausible guess. Perhaps if you could get us openssl(1) x509(1) information about the server, client and CA certificates, we could check on that. If you don't know how to do that, attach those certificates (and DO NOT attach private keys) to a Support ticket. Certificates are safe to post; they do not require secure handling.

regards, rob0

Thanks for the reply. I will gather the logs together and submit a ticket. Will update thread with ticket number too.

openvpnuser123

I'm also facing this issue when trying to connect to a Synology NAS.

Using the iOS client works fine, so it must be the Windows client that has a bug?

Looking at both logs I see this on the iOS client:

IV_VER=3.git::58b92569
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_GUI_VER=net.openvpn.connect.ios_3.2.3-3760
IV_SSO=openurl
IV_BS64DL=1

But I see this on the Windows client:

IV_VER=3.git::d3f8b18b
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:BF-CBC
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_GUI_VER=OCWindows_3.3.4-2600
IV_SSO=webauth,openurl,crtext
IV_BS64DL=1

Any noticable differences that could explain the problem?

I tried different old versions and managed to download: openvpn-connect-3.1.3.713_signed.msi
This version (3.1.3.713) works fine!

This is the log of version 3.1.3.713 on Windows:

IV_GUI_VER=OCmacOS_3.1.3-713
IV_VER=3.git::f225fcd0
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_BS64DL=1

Zephyr2084

Good day to all,

I want to communicate my situation as it is similar to what users are experiencing here.

My setup:
ISP Gateway -> Synology NAS OpenVPN server
Clients are Windows and Android devices using latest OpenVPN Connect version.

My findings:
Latest OpenVPN Connect on Android and OpenVPN Connect 3.3.X on Windows do not connect to the Synology NAS OpenVPN server IF the "Verify Server CN" option is checked on the Synology NAS VPN Server application.
This option will generate a client config file with the following:

</tls-auth>
verify-x509-name 'serveraddress' name

When the above is activated on the server and passed to all clients, the connection fails on Windows and Android running latest OpenVPN Connect version. HOWEVER, the connection succeeds using OpenVPN Connect 3.2.X on Windows (and used to work on Android before the last update) or the VPN GUI community supported application also on Windows.
I would consider this a solution for Windows if not for the fact that Android users are forced to use OpenVPN connect.

Disabling "Verify Server CN" on the Synology NAS Server and exporting the new config to all clients will allow the connection to work on both Android and Windows with latest OpenVPN connect.

I have approached Synology tech support on this (was also escalated to the developers) and they advise that this behavior is caused by a change in OpenVPN Connect from versions 3.2.X to 3.3.X and cite this forum as well.
To be clear, this issue was replicated by both Synology USA and their developers in Taiwan.

Hope this helps to solve the problem or at least provide a temporary workaround for the affected users.

Kind Regards

chaoscreater

Same here. If I use v3.3, it doesn't work (unless I remove the line starting with "verify-x509-name ..."

But if I use v2.7 or v3.2, then I don't have to remove anything in the config and it'll work fine.

DreamCypher

FYI,
I found that I did not have to remove the verify line, but instead needed to remove or replace the single-quotation marks.

Original Line: verify-x509-name 'serveraddress.synology.me' name

Working Line:
verify-x509-name serveraddress.synology.me name
OR
verify-x509-name "serveraddress.synology.me" name

Dream

ggjes

As a Mac user, it seems that OpenVPN Connect version 3.2.7 is my best hope at this point. I can't find a (reputable) link to that version anywhere on the web or openvpn.net. Does someone have a link they could provide?

DaRosenberg

DreamCypher wrote I found that I did not have to remove the verify line, but instead needed to remove or replace the single-quotation marks.

Thank you DreamCypher!! 😃 This did the trick for me too!

In my case the .ovpn profile comes generated from Azure VPN Gateway, with single quotes around the remote name. Removing those single quotes as per your suggestion solved the issue!

DaRosenberg

And a note to OpenVPN staff here who keep insisting this must be an issue with the configuration: Not sure what the config profile rules are, but it definitely seems like a bug having been introduced in the client, whereby single quotes around the remote name are being included in the name rather than trimmed away during parsing.

whatacharacter

DreamCypher wrote FYI,
I found that I did not have to remove the verify line, but instead needed to remove or replace the single-quotation marks.

+1
Thanks DreamCypher!
Created an account just to add another voice here confirming this is indeed the issue.

This same error occurs on Azure VPN gateway with OpenVPN when these marks are present in the .ovpn file.

daveinlv

I'm seeing the same error when I try to connect to my openvpn server. I'm currently seeing this exact error on a MacBookAir (OS 10.15.7), but am unable to connect to the server from my Android phone using the OpenVPN client for Android, nor on my Windows 10 laptop using the Windows OpenVpn client NOR my Kubuntu Linux laptop using its Openvpn. Until a few weeks ago, all of these systems were able to connect successfully to my openvpn server, which is running on an Asus RT-N66U router with FreshTomato Firmware 2022.2 MIPSR2 K26 USB AIO-64K. Version of Openvpn server used here is unknown.

All I see in the openvpn server log is the following:

Sep 24 12:29:33 svnetgw daemon.notice openvpn-server1[27811]: TCP connection established with [AF_INET6]::ffff:XX.XX.XX.XX:51902
Sep 24 12:29:33 svnetgw daemon.notice openvpn-server1[27811]: XX.XX.XX.XX:51902 TLS: Initial packet from [AF_INET6]::ffff:XX.XX.XX.XX:51902, sid=6ca4fb7c ba13392e
Sep 24 12:29:33 svnetgw daemon.err openvpn-server1[27811]: XX.XX.XX.XX:51902 Connection reset, restarting [0]
Sep 24 12:29:33 svnetgw daemon.notice openvpn-server1[27811]: XX.XX.XX.XX:51902 SIGUSR1[soft,connection-reset] received, client-instance restarting

Help!!

« Previous Page