I want to use openvpn from centos7, but been facing problems of TLS handshaking error (and WARNING: No server certificate verification method has been enabled.)

code of client.ovpn file

client
dev tap
proto udp
remote 202.79.XX.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
#ca wlink-ca.pem
ca ca.crt
comp-lzo
verb 3
auth-user-pass
route-method exe
route-delay 2

I have 4 files in /etc/openvpn

  1. ca.crt
  2. client.ovpn
  3. easy-rsa
  4. README.txt

Output:

sudo openvpn --config client.ovpn 
Wed Mar 15 11:22:31 2017 OpenVPN 2.3.14 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  7 2016
Wed Mar 15 11:22:31 2017 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Enter Auth Username: ***************
Enter Auth Password: *****
Wed Mar 15 11:22:45 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Mar 15 11:22:45 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Mar 15 11:22:45 2017 UDPv4 link local: [undef]
Wed Mar 15 11:22:45 2017 UDPv4 link remote: [AF_INET]202.79.XX.XXX:1194
Wed Mar 15 11:22:45 2017 TLS: Initial packet from [AF_INET]202.79.32.115:1194, sid=9b186f7d ff710a3f
Wed Mar 15 11:22:45 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Mar 15 11:22:46 2017 VERIFY OK: depth=1, C=NP, ST=Bagmati, L=Kathmandu, O=Worldlink, OU=System, CN=something, emailAddress=something@something.com.np
Wed Mar 15 11:22:46 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=NP, ST=Bagmati, O=Worldlink, OU=System, CN=something, emailAddress=something@something.com.np
Wed Mar 15 11:22:46 2017 OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Mar 15 11:22:46 2017 TLS_ERROR: BIO read tls_read_plaintext error
Wed Mar 15 11:22:46 2017 TLS Error: TLS object -> incoming plaintext read error
Wed Mar 15 11:22:46 2017 TLS Error: TLS handshake failed
Wed Mar 15 11:22:46 2017 SIGUSR1[soft,tls-error] received, process restarting
Wed Mar 15 11:22:46 2017 Restart pause, 2 second(s)
^CWed Mar 15 11:22:47 2017 SIGINT[hard,init_instance] received, process exiting
e here

How can i fix this issue?

  • Does the ovpn file have the public & private key made by easy-rsa embedded in it? – davidgo Mar 15 '17 at 9:06
  • 01.pem ca.key client.csr dh2048.pem index.txt.attr serial ca.crt client.crt client.key index.txt index.txt.old serial.old These are the files in /etc/openvpn/easy-rsa/2.0/keys/ I have pasted the codes of .ovpn file above. – spandan pradhan Mar 15 '17 at 9:54
  • I think we are talking past each other. Your ovpn files need to either imbed the contents of the appropriate files or you need directives cert /etc/openvpn/easy-rsa/2.0/keys/client.crt (enter) key/etc/openvpn/easy-rsa/2.0/keys/client.key (enter) and you may need to change the ca line to have the full path as well. – davidgo Mar 15 '17 at 9:58
  • Whenever i append these two ( cert /etc/openvpn/easy-rsa/2.0/keys/client.crt key /etc/openvpn/easy-rsa/2.0/keys/client.key ) lines, i get following error. sudo openvpn --config client.ovpn Options error: In [CMD-LINE]:1: Error opening configuration file: client.ovpn Use --help for more information. – spandan pradhan Mar 15 '17 at 10:10
  • Are you running openvpn as root? – davidgo Mar 15 '17 at 10:40

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.