openvpn client configuration on RPi - "OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate v

julienp

Hello, reaching out here after several unsuccessful investigations and testing. Help figuring out why the RPi openvpn client does not connect would be highly appreciated.

Will first try to summarise the baseline:
- I have a working OpenVPN server running version 2.4.11 - I think it uses OpenSSL 1.0.2k-fips
- I use it with a Viscosity client version 1.10 (1582) on macOS Catalina 10.15.7 - I think it uses OpenVPN 2.5.4 and OpenSSL 1.1.1l
- I generated a self-signed certificate for the OpenVPN server and certificates for clients using EasyRSA
- Connectivity between the Viscosity client and the OpenVPN server works fine. Until here all good.

Now I try the following:
- I setup a Raspberry Pi with Raspbian GNU/Linux 10 (buster)
- I installed and configure openvpn 2.4.7 client on Raspbian - I think is uses OpenSSL 1.1.1d
- I tried using a unique client key/certificate to connect to the OpenVPN server: the client fails to connect to the server
- I tried the exact same client key/certificate as I use on the Viscosity client above, and of course configured the server to allow multiple connections using the same certificate (duplicate-cn option): still the client fails to connect to the server

At some point I realised that the OpenVPN server had an out of sync clock, still the Viscosity client connected fine even with the clock being out of sync. Anyhow, I fixed that, and even with time clocks in sync, the Raspberry Pi client still won't connect.

Also I checked my CA certificate validity: it's valid until 2030...

# cat ca.crt | openssl x509 -noout -enddate
notAfter=May 10 13:32:22 2030 GMT

And I checked my client certificates, they are valid also until 2030 and they do have the TLS Web Client Authentication...

Validity
Not Before: Jun 17 21:35:24 2020 GMT
Not After : Jun 15 21:35:24 2030 GMT
...
X509v3 Extended Key Usage:
TLS Web Client Authentication

One thing which is strange is that I don't seem to be able to create new client certificates, I am not sure why, as this was previously possible.

# ./build-key rpi
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.

Below are the logs, note that I removed IP addresses and domain names on purpose.

When I log the Raspberry Pi failed connection attempt

What I see in the Raspberry Pi client log is "OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed";
And on the server I only see an initial packet log event. I do have the CA certificate locally on the Raspberry Pi, so I am not sure why a server certificate verification would fail?

Also in the Raspberry Pi client log is "++ Certificate has EKU (oid) 1.3.6.1.5.5.7.3.1, expects TLS Web Client Authentication" and then "VERIFY EKU ERROR". As said above, the certificates do have the TLS Web Client Authentication... and the same certificates work on the Viscosity client. So I am not sure what is wrong here?

Here is the Raspberry Pi client log:
Thu Nov 11 22:40:40 2021 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021
Thu Nov 11 22:40:40 2021 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Thu Nov 11 22:40:40 2021 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Thu Nov 11 22:40:40 2021 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Nov 11 22:40:40 2021 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Thu Nov 11 22:40:40 2021 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Nov 11 22:40:40 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]openvpn_server_ip:1194
Thu Nov 11 22:40:40 2021 Socket Buffers: R=[180224->180224] S=[180224->180224]
Thu Nov 11 22:40:40 2021 UDP link local: (not bound)
Thu Nov 11 22:40:40 2021 UDP link remote: [AF_INET]openvpn_server_ip:1194
Thu Nov 11 22:40:40 2021 TLS: Initial packet from [AF_INET]openvpn_server_ip:1194, sid=3238382d 1b910c18
Thu Nov 11 22:40:40 2021 VERIFY OK: depth=1, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=openvpn.mydomain.com, name=server, emailAddress=admin@mydomain.com
Thu Nov 11 22:40:40 2021 Validating certificate extended key usage
Thu Nov 11 22:40:40 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Client Authentication
Thu Nov 11 22:40:40 2021 ++ Certificate has EKU (oid) 1.3.6.1.5.5.7.3.1, expects TLS Web Client Authentication
Thu Nov 11 22:40:40 2021 VERIFY EKU ERROR
Thu Nov 11 22:40:40 2021 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Thu Nov 11 22:40:40 2021 TLS_ERROR: BIO read tls_read_plaintext error
Thu Nov 11 22:40:40 2021 TLS Error: TLS object -> incoming plaintext read error
Thu Nov 11 22:40:40 2021 TLS Error: TLS handshake failed
Thu Nov 11 22:40:40 2021 SIGUSR1[soft,tls-error] received, process restarting
Thu Nov 11 22:40:40 2021 Restart pause, 5 second(s)
Thu Nov 11 22:40:45 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]openvpn_server_ip:1194
Thu Nov 11 22:40:45 2021 Socket Buffers: R=[180224->180224] S=[180224->180224]
Thu Nov 11 22:40:45 2021 UDP link local: (not bound)
Thu Nov 11 22:40:45 2021 UDP link remote: [AF_INET]openvpn_server_ip:1194
Thu Nov 11 22:40:45 2021 TLS: Initial packet from [AF_INET]openvpn_server_ip:1194, sid=930a1573 bf214b92
Thu Nov 11 22:40:45 2021 VERIFY OK: depth=1, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=openvpn.mydomain.com, name=server, emailAddress=admin@mydomain.com
Thu Nov 11 22:40:45 2021 Validating certificate extended key usage
Thu Nov 11 22:40:45 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Client Authentication
Thu Nov 11 22:40:45 2021 ++ Certificate has EKU (oid) 1.3.6.1.5.5.7.3.1, expects TLS Web Client Authentication
Thu Nov 11 22:40:45 2021 VERIFY EKU ERROR
Thu Nov 11 22:40:45 2021 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Thu Nov 11 22:40:45 2021 TLS_ERROR: BIO read tls_read_plaintext error
Thu Nov 11 22:40:45 2021 TLS Error: TLS object -> incoming plaintext read error
Thu Nov 11 22:40:45 2021 TLS Error: TLS handshake failed
Thu Nov 11 22:40:45 2021 SIGUSR1[soft,tls-error] received, process restarting
Thu Nov 11 22:40:45 2021 Restart pause, 5 second(s)
Thu Nov 11 22:40:48 2021 SIGINT[hard,init_instance] received, process exiting

And on the server I see:

Thu Nov 11 22:40:40 2021 90.90.142.244:34225 TLS: Initial packet from [AF_INET]my_client_ip:34225, sid=8625e0f3 09d9baba
Thu Nov 11 22:40:45 2021 90.90.142.244:37294 TLS: Initial packet from [AF_INET]my_client_ip:37294, sid=eac7f789 963f590b

When I log the Viscosity successful connection attempt

Although there are various warnings, the connection is successful:

2021-11-11 22:28:22: Viscosity Mac 1.10 (1582)
2021-11-11 22:28:22: Viscosity OpenVPN Engine Started
2021-11-11 22:28:22: Running on macOS 10.15.7
2021-11-11 22:28:22: ---------
2021-11-11 22:28:22: State changed to Connecting
2021-11-11 22:28:22: Checking reachability status of connection...
2021-11-11 22:28:23: Connection is reachable. Starting connection attempt.
2021-11-11 22:28:23: --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2021-11-11 22:28:23: OpenVPN 2.5.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Oct 22 2021
2021-11-11 22:28:23: library versions: OpenSSL 1.1.1l 24 Aug 2021, LZO 2.10
2021-11-11 22:28:23: Valid endpoint found: server_ip:1194:udp
2021-11-11 22:28:23: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2021-11-11 22:28:23: TCP/UDP: Preserving recently used remote address: [AF_INET]server_ip:1194
2021-11-11 22:28:23: UDP link local: (not bound)
2021-11-11 22:28:23: UDP link remote: [AF_INET]server_ip:1194
2021-11-11 22:28:23: State changed to Authenticating
2021-11-11 22:28:23: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1558'
2021-11-11 22:28:23: WARNING: 'keysize' is used inconsistently, local='keysize 128', remote='keysize 256'
2021-11-11 22:28:23: [server] Peer Connection Initiated with [AF_INET]server_ip:1194
2021-11-11 22:28:23: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-11-11 22:28:23: Opened utun device utun13
2021-11-11 22:28:23: /sbin/ifconfig utun13 delete
2021-11-11 22:28:23: NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2021-11-11 22:28:23: /sbin/ifconfig utun13 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2021-11-11 22:28:23: DNS mode set to Split
2021-11-11 22:28:23: DNS Server/s: 192.168.1.2
2021-11-11 22:28:23: DNS Domains/s: localdomain.local, sps.local
2021-11-11 22:28:23: WARNING: A .local domain is present in the DNS domain list. The .local domain is reserved for mDNS. Using it as a DNS domain may cause DNS resolution attempts to fail or unexpected DNS behaviour.
2021-11-11 22:28:24: State changed to Connected
2021-11-11 22:28:24: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-11-11 22:28:24: Initialization Sequence Completed

And on the server I see:

Thu Nov 11 22:00:39 2021 my_client_ip:54881 TLS: Initial packet from [AF_INET]90.90.142.244:54881, sid=d66530ab 885b6eee
Thu Nov 11 22:00:39 2021 my_client_ip:54881 VERIFY OK: depth=1, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=mydomain.com, name=server, emailAddress=admin@mydomain.com
Thu Nov 11 22:00:39 2021 my_client_ip:54881 VERIFY OK: depth=0, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=myname, name=server, emailAddress=admin@mydomain.com
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_VER=2.5.4
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_PLAT=mac
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_PROTO=22
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_NCP=2
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_LZ4=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_LZ4v2=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_LZO=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_COMP_STUB=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_COMP_STUBv2=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_TCPNL=1
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_GUI_VER=Viscosity_1.10_1582
Thu Nov 11 22:00:39 2021 my_client_ip:54881 peer info: IV_SSO=openurl,crtext
Thu Nov 11 22:00:39 2021 my_client_ip:54881 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'
Thu Nov 11 22:00:39 2021 my_client_ip:54881 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher AES-256-CBC'
Thu Nov 11 22:00:39 2021 my_client_ip:54881 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
Thu Nov 11 22:00:39 2021 my_client_ip:54881 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Thu Nov 11 22:00:39 2021 my_client_ip:54881 [myuser] Peer Connection Initiated with [AF_INET]90.90.142.244:54881
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 MULTI_sva: pool returned IPv4=10.8.0.3, IPv6=(Not enabled)
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 MULTI: Learn: 10.8.0.3 -> myuser/my_client_ip:54881
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 MULTI: primary virtual IP for myuser/my_client_ip:54881: 10.8.0.3
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 PUSH: Received control message: 'PUSH_REQUEST'
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 SENT CONTROL [myuser]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.2,dhcp-option DOMAIN localdomain.local,compress lz4-v2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.3 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Nov 11 22:00:39 2021 myuser/my_client_ip:54881 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

The working Viscosity client configuration:

client
tls-client
ca ca.crt
cert mycert.crt
key mycert.key
tls-crypt myvpn.tlsauth
remote-cert-eku "TLS Web Client Authentication"
proto udp
remote openvpn_server_ip 1194 udp
dev tun
topology subnet
pull
user nobody
group nobody

The non-working Raspberry Pi client configuration:

client
tls-client
ca ca.crt
cert mycert.crt
key mycert.key
tls-crypt myvpn.tlsauth
remote-cert-eku "TLS Web Client Authentication"
proto udp
remote openvpn_server_ip 1194 udp
nobind
comp-lzo
dev tun
topology subnet
pull
persist-key
permit-tun
verb 3

The working OpenVPN server configuration (at least working with Viscosity):

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.2"
push "dhcp-option DOMAIN localdomain.local"
duplicate-cn # I added this to test the same certificate and key used with Viscosity but with the Raspberry Pi
keepalive 10 120
tls-crypt myvpn.tlsauth
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
explicit-exit-notify 1

TinCanTech

julienp wrote remote-cert-eku "TLS Web Client Authentication"

This is incorrect, from the client the remote-cert-eku is a server.

--remote-cert-eku oid

Require that peer certificate was signed with an explicit extended key usage.

This is a useful security option for clients, to ensure that the host they connect to is a designated server.

The extended key usage should be encoded in oid notation, or OpenSSL symbolic representation.

julienp wrote The working Viscosity client configuration:
<snip>
remote-cert-eku "TLS Web Client Authentication"

Either, you have the wrong details in this post or Viscosity has a fairly significant security bug..

julienp

Thank you for your review and analysis. Very much appreciated!

Just to be sure I understand what you mean. You are indicating that:
- I should only set the –remote-cert-tls client option and do so on the server only? With remote-cert-eku "TLS Web Client Authentication"
- I should only set the –remote-cert-tls server option and do so on the client(s) only? With remote-cert-eku "TLS Web Server Authentication"

If that's right, then I can test this and find out the various results with Viscosity and the RPi client.

But to answer your question, yes, Viscosity is connecting fine with this configuration: I verified again the logs and the configuration of the Viscosity client, it is set with –remote-cert-tls client. But the logs do show "WARNING: No server certificate verification method has been enabled. " maybe that is the reason?

TinCanTech

julienp wrote Just to be sure I understand what you mean. You are indicating that:
- I should only set the –remote-cert-tls client option and do so on the server only? With remote-cert-eku "TLS Web Client Authentication"
- I should only set the –remote-cert-tls server option and do so on the client(s) only? With remote-cert-eku "TLS Web Server Authentication"

LGTM.

julienp wrote Viscosity is connecting fine with this configuration: I verified again the logs and the configuration of the Viscosity client, it is set with –remote-cert-tls client. But the logs do show "WARNING: No server certificate verification method has been enabled. "

Then either, Viscosity has a huge security bug or you have, once again, posted the wrong log file.

julienp

So as a follow-up here to the last thread exchange... a few things are new.

Feedback 1)
First, about the Viscosity client, I opened a thread on the Viscosity community and am waiting for response there.

Feedback 2)
Note that I did not change the openvpn server configuration because I have not found mention of those parameters in the sample server.conf file... I suppose that's where I should add them but I found it strange there is no mention of those parameters in the sample configuration file !?
Should I simply take the command line parameters, remove the prefix -- and add those to the server configuration file?

Feedback 3)
The Raspberry Pi openvpn client configuration is indeed working with the modified settings meaning with the following two changes:
1) remote-cert-tls server
2) remote-cert-eku "TLS Web Server Authentication"
where 1 is added to the config and 2 changed compared to the faulty configuration.

That's great because it works and proves the point about those parameters, but... it works only if the configuration is loaded manually. If I happen to load the configuration with --daemon option then it fails. And I do not understand why. Some help for this new issue would be welcome. Below are the logs of both a manual configuration load and a daemon attempt.

The error when I try to load the configuration with the daemon option is about a cipher issue and that it cannot load the keyfile.

--cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2021-11-14 22:49:21 Cannot pre-load keyfile (myvpn.tlsauth)
2021-11-14 22:49:21 Exiting due to fatal error

I do not understand the cipher issue as I do not see any configuration parameters related to ciphers. The log mentions command-line paremeters but should I add those as configuration items in the configuration file without the prefix -- ? And should I add those in the client or server or both?
Then, the key file it is complaining about "myvpn.tlsauth" is present on the client so not sure why it says it cannot pre-load it... what is different about loading in daemon mode?

Manual configuration load (successful)

2021-11-14 22:40:23 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2021-11-14 22:40:23 OpenVPN 2.5.1 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2021-11-14 22:40:23 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2021-11-14 22:40:23 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-11-14 22:40:23 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-11-14 22:40:23 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-11-14 22:40:23 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-11-14 22:40:23 TCP/UDP: Preserving recently used remote address: [AF_INET] openvpn_server_ip:1194
2021-11-14 22:40:23 Socket Buffers: R=[180224->180224] S=[180224->180224]
2021-11-14 22:40:23 UDP link local (bound): [AF_INET][undef]:1194
2021-11-14 22:40:23 UDP link remote: [AF_INET] openvpn_server_ip:1194
2021-11-14 22:40:23 TLS: Initial packet from [AF_INET]openvpn_server_ip:1194, sid=9e72bc2c 6b312fae
2021-11-14 22:40:24 VERIFY OK: depth=1, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=mydomain.com, name=server, emailAddress=admin@mydomain.com
2021-11-14 22:40:24 VERIFY KU OK
2021-11-14 22:40:24 Validating certificate extended key usage
2021-11-14 22:40:24 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-11-14 22:40:24 VERIFY EKU OK
2021-11-14 22:40:24 VERIFY OK: depth=0, C=FR, ST=IF, L=Paris, O=Test Lab, OU=TestLab, CN=server, name=server, emailAddress=admin@ mydomain.com
2021-11-14 22:40:24 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1558'
2021-11-14 22:40:24 WARNING: 'keysize' is used inconsistently, local='keysize 128', remote='keysize 256'
2021-11-14 22:40:24 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021-11-14 22:40:24 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
2021-11-14 22:40:24 [server] Peer Connection Initiated with [AF_INET] openvpn_server_ip:1194
2021-11-14 22:40:25 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2021-11-14 22:40:25 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.2,dhcp-option DOMAIN localdomain.local,compress lz4-v2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2021-11-14 22:40:25 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-11-14 22:40:25 OPTIONS IMPORT: timers and/or timeouts modified
2021-11-14 22:40:25 OPTIONS IMPORT: compression parms modified
2021-11-14 22:40:25 OPTIONS IMPORT: --ifconfig/up options modified
2021-11-14 22:40:25 OPTIONS IMPORT: route options modified
2021-11-14 22:40:25 OPTIONS IMPORT: route-related options modified
2021-11-14 22:40:25 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021-11-14 22:40:25 OPTIONS IMPORT: peer-id set
2021-11-14 22:40:25 OPTIONS IMPORT: adjusting link_mtu to 1624
2021-11-14 22:40:25 OPTIONS IMPORT: data channel crypto options modified
2021-11-14 22:40:25 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-11-14 22:40:25 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-14 22:40:25 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-14 22:40:25 net_route_v4_best_gw query: dst 0.0.0.0
2021-11-14 22:40:25 net_route_v4_best_gw result: via 192.168.0.1 dev eth0
2021-11-14 22:40:25 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:53:c8:d3
2021-11-14 22:40:25 TUN/TAP device tun0 opened
2021-11-14 22:40:25 net_iface_mtu_set: mtu 1500 for tun0
2021-11-14 22:40:25 net_iface_up: set tun0 up
2021-11-14 22:40:25 net_addr_v4_add: 10.8.0.2/24 dev tun0
2021-11-14 22:40:25 net_route_v4_add: 192.168.1.0/24 via 10.8.0.1 dev [NULL] table 0 metric -1
2021-11-14 22:40:25 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-11-14 22:40:25 Initialization Sequence Completed

Daemon configuration load (not successful)

2021-11-14 22:40:25 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-11-14 22:40:25 Initialization Sequence Completed
2021-11-14 22:49:21 event_wait : Interrupted system call (code=4)
2021-11-14 22:49:21 net_route_v4_del: 192.168.1.0/24 via 10.8.0.1 dev [NULL] table 0 metric -1
2021-11-14 22:49:21 Closing TUN/TAP interface
2021-11-14 22:49:21 net_addr_v4_del: 10.8.0.2 dev tun0
2021-11-14 22:49:21 SIGHUP[hard,] received, process restarting
2021-11-14 22:49:21 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2021-11-14 22:49:21 Cannot pre-load keyfile (myvpn.tlsauth)
2021-11-14 22:49:21 Exiting due to fatal error

TinCanTech

Please post complete log files not snippets.

You can also inline files.