Error: ssl_cleartext BIO_read failed

[miksmith]

Hi

I have recently moved to a new Synology NAS running their VPN plugin which incorporates OVPN and set up the server as follows:

-the IP/name of the NAS is a dropin replacement so port forwarding on the router will continue to work
-used the default app on the NAS settings which generated the .ovpn file below
-imported to OVPN on Android and inserted user name and password
-I get the following error message on the client:

Code: Select all

openvpn opensslcontext::ssl_cleartext BIO_read failed cap=2576 status=-1 error:1416f086 ssl routine:tls_process_server_certificate certificate verify failed

Im not sure what this error means and so how to go about fixing it. Any help much appreciated!

thanks

mike

View OriginalClient config

1

2

3

dev tun

4

5

tls-client

6

7

8

9

remote myserver.synology.me 1194

10

11

12

13

# The "float" tells OpenVPN to accept authenticated packets from any address,

14

15

# not only the address which was specified in the --remote option.

16

17

# This is useful when you are connecting to a peer which holds a dynamic address

18

19

# such as a dial-in user or DHCP client.

20

21

# (Please refer to the manual of OpenVPN for more information.)

22

23

24

25

#float

26

27

28

29

# If redirect-gateway is enabled, the client will redirect it's

30

31

# default network gateway through the VPN.

32

33

# It means the VPN connection will firstly connect to the VPN Server

34

35

# and then to the internet.

36

37

# (Please refer to the manual of OpenVPN for more information.)

38

39

40

41

redirect-gateway def1

42

43

44

45

# dhcp-option DNS: To set primary domain name server address.

46

47

# Repeat this option to set secondary DNS server addresses.

48

49

50

51

dhcp-option DNS 192.168.2.254

52

53

54

55

pull

56

57

58

59

# If you want to connect by Server's IPv6 address, you should use

60

61

# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode

62

63

proto udp

64

65

66

67

script-security 2

68

69

70

71

comp-lzo

72

73

74

75

reneg-sec 0

76

77

78

79

cipher AES-256-CBC

80

81

82

83

auth SHA512

84

85

86

87

auth-user-pass

88

89

<ca>

90

--STRIPPED INLINE CA CERT--

91

</ca>

92

1

dev tun

2

tls-client

3

remote myserver.synology.me 1194

4

redirect-gateway def1

5

dhcp-option DNS 192.168.2.254

6

pull

7

proto udp

8

script-security 2

9

comp-lzo

10

reneg-sec 0

11

cipher AES-256-CBC

12

auth SHA512

13

auth-user-pass

14

<ca>

15

--STRIPPED INLINE CA CERT--

16

</ca>

[TinCanTech]

-I get the following error message on the client:

Code: Select all

openvpn opensslcontext::ssl_cleartext BIO_read failed cap=2576 status=-1 error:1416f086 ssl routine:tls_process_server_certificate certificate verify failed

Im not sure what this error means and so how to go about fixing it. Any help much appreciated!

It means the server certificate failed verification. Probably, you have used the wrong certificate somewhere ..

Take a look at your server log at --verb 4 as well.

Please see:
viewtopic.php?f=30&t=22603#p68963

[miksmith]

Thanks for the help... I went back through the entire setup and found it worked internally in my network which meant it had to be a problem with either the DDNS or port forwarding on the router. Turned out it was the latter as whilst I had used the name/IP of the old NAS, the router was using the MAC address. As a result I was trying to connect to the old NAS with the new cert!!

All working now.

Thanks again for the pointer

[TinCanTech]

Thanks for letting us know

[jery]

Hi,
I think I have the same error.
How can I solve.
LOG>

⏎[Dec 13, 2023, 01:13:30] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2640 status=-1: error:0A000086:SSL routines::certificate verify failed
⏎[Dec 13, 2023, 01:13:30] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2640 status=-1: error:0A000086:SSL routines::certificate verify failed⏎[Dec 13, 2023, 01:13:30] EVENT: DISCONNECTED ⏎