Certificate verify failed

[Hell]

Hello everyone,

I'm trying to get OpenVPN to work on my iPhone 11 but I'm facing this issue :
https://zupimages.net/viewer.php?id=21/49/07ld.jpg

I specify that I connected in SSH and in "root" on the console of my synology and that I can see the packets arrived during my connection attempt. I get this before I get the error message :
https://zupimages.net/viewer.php?id=21/49/g06s.jpg

Someone can help me ?

Thank you



This message is translated from google translate

[TinCanTech]

Please start here: viewtopic.php?f=30&t=22603#p68963

[Hell]

Ok sorry.



* Serveur *

My server configuration file :
Managed by my synology NAS

My server log file :
I don't think I have one, because it is managed by my synology NAS



* Client *

iOS 14.3 (18C66)

My client log file :

Code: Select all

2021-12-08 22:03:01 1

2021-12-08 22:03:01 ----- OpenVPN Start -----
OpenVPN core 3.git::58b92569 ios arm64 64-bit

2021-12-08 22:03:01 OpenVPN core 3.git::58b92569 ios arm64 64-bit

2021-12-08 22:03:01 Frame=512/2048/512 mssfix-ctrl=1250

2021-12-08 22:03:01 UNUSED OPTIONS
1 [tls-client]
3 [pull]
5 [script-security] [2]

2021-12-08 22:03:01 EVENT: RESOLVE

2021-12-08 22:03:01 Contacting [xxxx]:1194/UDP via UDP

2021-12-08 22:03:01 EVENT: WAIT

2021-12-08 22:03:01 Connecting to [xxxx]:1194 (xxxx) via UDPv4

2021-12-08 22:03:01 EVENT: CONNECTING

2021-12-08 22:03:01 Tunnel Options:V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client

2021-12-08 22:03:01 Creds: Username/Password

2021-12-08 22:03:01 Peer Info:
IV_VER=3.git::58b92569
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_GUI_VER=net.openvpn.connect.ios_3.2.3-3760
IV_SSO=openurl


2021-12-08 22:03:01 VERIFY FAIL: depth=2, /C=US/O=Internet Security Research Group/CN=ISRG Root X1 [unable to get issuer certificate]

2021-12-08 22:03:01 Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

2021-12-08 22:03:01 EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed [ERR]

2021-12-08 22:03:01 Raw stats on disconnect:
BYTES_IN : 4800
BYTES_OUT : 383
PACKETS_IN : 6
PACKETS_OUT : 5
SSL_ERROR : 1

2021-12-08 22:03:01 Performance stats on disconnect:
CPU usage (microseconds): 52475
Network bytes per CPU second: 98770
Tunnel bytes per CPU second: 0

2021-12-08 22:03:01 EVENT: DISCONNECTED

2021-12-08 22:03:01 Raw stats on disconnect:
BYTES_IN : 4800
BYTES_OUT : 383
PACKETS_IN : 6
PACKETS_OUT : 5
SSL_ERROR : 1
CERT_VERIFY_FAIL : 1

2021-12-08 22:03:01 Performance stats on disconnect:
CPU usage (microseconds): 63104
Network bytes per CPU second: 82134
Tunnel bytes per CPU second: 0

My client configuration file :

View Originalclient

1

dev tun

2

3

tls-client

4

5

6

7

remote xxxx 1194

8

9

10

11

# The "float" tells OpenVPN to accept authenticated packets from any address,

12

13

# not only the address which was specified in the --remote option.

14

15

# This is useful when you are connecting to a peer which holds a dynamic address

16

17

# such as a dial-in user or DHCP client.

18

19

# (Please refer to the manual of OpenVPN for more information.)

20

21

22

23

#float

24

25

26

27

# If redirect-gateway is enabled, the client will redirect it's

28

29

# default network gateway through the VPN.

30

31

# It means the VPN connection will firstly connect to the VPN Server

32

33

# and then to the internet.

34

35

# (Please refer to the manual of OpenVPN for more information.)

36

37

38

39

#redirect-gateway def1

40

41

42

43

# dhcp-option DNS: To set primary domain name server address.

44

45

# Repeat this option to set secondary DNS server addresses.

46

47

48

49

#dhcp-option DNS DNS_IP_ADDRESS

50

51

52

53

pull

54

55

56

57

# If you want to connect by Server's IPv6 address, you should use

58

59

# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode

60

61

proto udp

62

63

64

65

script-security 2

66

67

68

69

70

71

72

73

reneg-sec 0

74

75

76

77

cipher AES-256-CBC

78

79

80

81

auth SHA512

82

83

84

85

auth-user-pass

86

87

<ca>

88

--STRIPPED INLINE CA CERT--

1

dev tun

2

tls-client

3

remote xxxx 1194

4

pull

5

proto udp

6

script-security 2

7

reneg-sec 0

8

cipher AES-256-CBC

9

auth SHA512

10

auth-user-pass

11

<ca>

12

--STRIPPED INLINE CA CERT--

Tell me if need more information or if I'm on the wrong track.


Thank you for your help.


This message is translated from google translate.

[TinCanTech]

My server log file :
I don't think I have one, because it is managed by my synology NAS

No log, no eye-deer.

Look again ..