mbed TLS: SSL read error : SSL - Processing of the Certificate handshake message failed

Post Reply
zapa
OpenVpn Newbie
Posts: 1
Joined: Fri Apr 20, 2018 11:27 am

mbed TLS: SSL read error : SSL - Processing of the Certificate handshake message failed

Post by zapa » Fri Jun 29, 2018 8:50 am

Hello,
I use Openvpn Connect 3.0.6 on Android and OpenVPN 2.4.6 on linux server.
I have .ovpn conf file working on Windows, but not workind on Android

I got these logs:
//////////
client log
//////////
08:34:37.792 -- ----- OpenVPN Start -----
08:34:37.793 -- EVENT: CORE_THREAD_ACTIVE
08:34:37.798 -- Frame=512/2048/512 mssfix-ctrl=1250
08:34:37.800 -- UNUSED OPTIONS
4 [resolv-retry] [infinite]
5 [persist-key]
6 [persist-tun]
11 [verb] [4]

08:34:37.802 -- EVENT: RESOLVE
08:34:37.814 -- Contacting x.x.x.x:1196 via UDP
08:34:37.815 -- EVENT: WAIT
08:34:37.916 -- Connecting to [x.x.x.x]:1196 (x.x.x.x) via UDPv4
08:34:37.917 -- EVENT: CONNECTING
08:34:37.921 -- Tunnel Options:V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client

08:34:37.922 -- Creds: UsernameEmpty/PasswordEmpty

08:34:37.923 -- Peer Info:
IV_GUI_VER=OC30Android
IV_VER=3.2
IV_PLAT=android
IV_LZO=1
IV_AUTO_SESS=1
IV_BS64DL=1

08:34:37.923 -- VERIFY OK : depth=1
cert. version : 3
serial number : 5C:90:69:CF:5D:FB:DE:9C:44:2A:6D:09:80:C2:62:23
issuer name : L=Town, OU=Centrala, O=COMPANY spol. s r. o., DC=cz, DC=COMPANY, CN=COMPANY VPN CA 5
subject name : L=Town, OU=Centrala, O=COMPANY spol. s r. o., DC=cz, DC=COMPANY, CN=COMPANY VPN CA 5
issued on : 2018-03-02 14:56:28
expires on : 2038-03-02 15:06:26
signed using : RSA with SHA-256
RSA key size : 4096 bits
basic constraints : CA=true
key usage : Digital Signature, Key Cert Sign, CRL Sign

08:34:37.924 -- VERIFY OK : depth=0
cert. version : 3
serial number : 44:00:00:00:39:E3:8B:5B:32:A3:0D:61:79:00:00:00:00:00:39
issuer name : L=Town, OU=Centrala, O=COMPANY spol. s r. o., DC=cz, DC=COMPANY, CN=COMPANY VPN CA 5
subject name : L=Town, O=COMPANY spol. s r.o., OU=centrala, CN=ovpn2-ji.COMPANY.cz
issued on : 2018-03-22 10:34:10
expires on : 2020-03-22 10:44:10
signed using : RSA with SHA-256
RSA key size : 2048 bits
key usage : Key Encipherment, Data Encipherment
ext key usage : TLS Web Server Authentication

08:34:37.925 -- Client exception in transport_recv_excode: mbed TLS: SSL read error : SSL - Processing of the Certificate handshake message failed
08:34:37.926 -- Client terminated, restarting in 2000 ms...
08:34:39.849 -- EVENT: RECONNECTING
///////////
server log
///////////
Fri Jun 29 08:47:33 2018 us=416479 192.168.50.2:56403 TLS: Initial packet from [AF_INET]192.168.50.2:56403, sid=9881ecb9 e17973ef
Fri Jun 29 08:47:35 2018 us=517479 MULTI: multi_create_instance called
Fri Jun 29 08:47:35 2018 us=517598 192.168.50.2:58225 Re-using SSL/TLS context
Fri Jun 29 08:47:35 2018 us=517635 192.168.50.2:58225 LZO compression initializing
Fri Jun 29 08:47:35 2018 us=517749 192.168.50.2:58225 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Fri Jun 29 08:47:35 2018 us=517786 192.168.50.2:58225 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Fri Jun 29 08:47:35 2018 us=517854 192.168.50.2:58225 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Fri Jun 29 08:47:35 2018 us=517889 192.168.50.2:58225 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
///////////

Keyusage of the certificate on server side is "server"
Could you advice me ?
Pavel

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 4804
Joined: Fri Jun 03, 2016 1:17 pm

Re: mbed TLS: SSL read error : SSL - Processing of the Certificate handshake message failed

Post by TinCanTech » Fri Jun 29, 2018 12:56 pm

How did you create your certificates ?

Also, you could post the successful Windows client log.

Post Reply