OpenSSL error:1416F086 tls_process_server_certificate:certificate verify failed

jimmyp82

Hello

New to this forum and very new to openvpn. I have inherited a setup so am trying to get my head around it. We have a user which is having an issue connecting. Below is the log from the user.

Prior to this he was getting a different error about the certificate having expired.

I found that the client cert was still valid however the ca.crt and the gateway.crt on the server were both out of date. I used this command -

openssl x509 -in ca.crt -days 36500 -out ca_new.crt -signkey ca.key

to sign a new ca.crt and a gateway.crt which I replaced, ie renamed the old crt and put the new ca.crt in place. I also sent the user the updated ca.crt.

After having done that however the user now gets the error below -

Wed Jun 30 11:30:07 2021 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Wed Jun 30 11:30:07 2021 MANAGEMENT: >STATE:1625045407,RESOLVE,,,,,,
Wed Jun 30 11:30:07 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]XXXXXXXXX:XXXX
Wed Jun 30 11:30:07 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jun 30 11:30:07 2021 Attempting to establish TCP connection with [AF_INET]XXXXXXXXX:XXXX [nonblock]
Wed Jun 30 11:30:07 2021 MANAGEMENT: >STATE:1625045407,TCP_CONNECT,,,,,,
Wed Jun 30 11:30:08 2021 TCP connection established with [AF_INET]XXXXXXXXX:XXXX
Wed Jun 30 11:30:08 2021 TCP_CLIENT link local: (not bound)
Wed Jun 30 11:30:08 2021 TCP_CLIENT link remote: [AF_INET]XXXXXXXXX:XXXX
Wed Jun 30 11:30:08 2021 MANAGEMENT: >STATE:1625045408,WAIT,,,,,,
Wed Jun 30 11:30:09 2021 MANAGEMENT: >STATE:1625045409,AUTH,,,,,,
Wed Jun 30 11:30:09 2021 TLS: Initial packet from [AF_INET]XXXXXXXXX:XXXX, sid=4b062365 dc720dc0
Wed Jun 30 11:30:09 2021 VERIFY OK: depth=1, C=UK, ST=UK, L=London, O=XXXXXXXXX, CN=gateway, emailAddress=XXXXXXXXX
Wed Jun 30 11:30:09 2021 VERIFY ERROR: depth=0, error=certificate signature failure: C=UK, ST=UK, L=London, O=XXXXXXX, CN=gateway, emailAddress=XXXXXXXXXXX
Wed Jun 30 11:30:09 2021 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wed Jun 30 11:30:09 2021 TLS_ERROR: BIO read tls_read_plaintext error
Wed Jun 30 11:30:09 2021 TLS Error: TLS object -> incoming plaintext read error
Wed Jun 30 11:30:09 2021 TLS Error: TLS handshake failed
Wed Jun 30 11:30:09 2021 Fatal TLS error (check_tls_errors_co), restarting
Wed Jun 30 11:30:09 2021 SIGUSR1[soft,tls-error] received, process restarting
Wed Jun 30 11:30:09 2021 MANAGEMENT: >STATE:1625045409,RECONNECTING,tls-error,,,,,
Wed Jun 30 11:30:09 2021 Restart pause, 5 second(s)

Any help much appreciated!

Thanks
James

TinCanTech

jimmyp82 wrote the ca.crt and the gateway.crt on the server were both out of date

Your CA has expired. You need to start all over again from scratch.

You will need easyrsa:
https://github.com/OpenVPN/easy-rsa

And this can help a lot:
https://github.com/TinCanTech/easy-tls

jimmyp82 wrote I have inherited a setup

If you require professional help then I am available for hire: tincantech at protonmail dot com

jimmyp82

Hello

Thanks for the reply!

So you mean everything has to be recreated again, ie CA and gateway and client crts and the keys as well?

Thanks

300000

If you create new CA key so you need create new client key too . nothing you can do or there is nothing about renew certificate . what do you expect now? do it again on 10 years time then do it again . every 10 years you need to do this .

openvpn_inc

300000 wrote If you create new CA key so you need create new client key too . nothing you can do or there is nothing about renew certificate . what do you expect now? do it again on 10 years time then do it again . every 10 years you need to do this .

10 years is just long enough to forget how to do it. 🙂

Strictly speaking, a new CA certificate means you need a new set of certificates, not keys. Existing keys (CA, server and clients) can generate new CSRs (certificate signing requests) to be signed by the CA and create the new certificates.

If the CA is creating the keys for the users, this distinction might not be important to you. But when my own 10-year CA cert expired I kept the same keys.

Regards, rob0

TinCanTech

openvpn_inc wrote when my own 10-year CA cert expired I kept the same keys

That is fine for you but is probably not a good idea for most average users.

It is not documented by any openvpn articles that I've seen and even Easy-RSA does not have anything solid to follow ..

jimmyp82

Hello

I got a bit further, now testing with a new client i have setup on a laptop however getting this -

Fri Jul 02 04:59:12 2021 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Fri Jul 02 04:59:12 2021 MANAGEMENT: >STATE:1625227152,RESOLVE,,,,,,
Fri Jul 02 04:59:12 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.XXX.XXX.XX:1194
Fri Jul 02 04:59:12 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jul 02 04:59:12 2021 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XX:1194 [nonblock]
Fri Jul 02 04:59:12 2021 MANAGEMENT: >STATE:1625227152,TCP_CONNECT,,,,,,
Fri Jul 02 05:01:13 2021 TCP: connect to [AF_INET]XXX.XXX.XXX.XX1194 failed: Unknown error
Fri Jul 02 05:01:13 2021 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Fri Jul 02 05:01:13 2021 MANAGEMENT: >STATE:1625227273,RECONNECTING,init_instance,,,,,
Fri Jul 02 05:01:13 2021 Restart pause, 5 second(s)
Fri Jul 02 05:01:18 2021 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Fri Jul 02 05:01:18 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.XXX.XXX.XX:1194
Fri Jul 02 05:01:18 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jul 02 05:01:18 2021 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XX:1194 [nonblock]
Fri Jul 02 05:01:18 2021 MANAGEMENT: >STATE:1625227278,TCP_CONNECT,,,,,,

openvpn_inc

jimmyp82 wrote Hello

I got a bit further, now testing with a new client i have setup on a laptop however getting this -

Fri Jul 02 04:59:12 2021 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.

Fix this, that should be easy enough to do, see the manual and look for "--remote-cert-tls".

jimmyp82 wrote Fri Jul 02 04:59:12 2021 MANAGEMENT: >STATE:1625227152,RESOLVE,,,,,,
Fri Jul 02 04:59:12 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.XXX.XXX.XX:1194
Fri Jul 02 04:59:12 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jul 02 04:59:12 2021 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XX:1194 [nonblock]
Fri Jul 02 04:59:12 2021 MANAGEMENT: >STATE:1625227152,TCP_CONNECT,,,,,,
Fri Jul 02 05:01:13 2021 TCP: connect to [AF_INET]XXX.XXX.XXX.XX1194 failed: Unknown error

Here you have a TCP connection failing for an unknown reason. It's unfortunate that more information could not be logged, but openvpn simply could not determine the actual failure. If the connection is not established, the problem almost surely lies outside of openvpn.

Our IRC channel /topic says, "The problem is your firewall, really." That's the chief suspect here, and note that it could be a firewall anywhere along the way between (or on client and server. Look at other tools like tcpdump(1) to see more about what the problem might be. Your nc(1) or netcat(1) utility can help you test.

I should add, TCP is generally not recommended for openvpn. It should normally only be used when getting through silly firewalls that you don't control. Packet loss of a TCP stream inside another TCP stream rapidly snowballs into more and more packets being repeated at both levels. UDP is ideal for things like this.

I hope this helps, good luck. Regards, rob0