TLS Error upon connnecting in PFsense server with openvpn client
-
I've worked this for two days but can't figured out the solution. Please help
Mon Aug 03 12:38:20 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mon Aug 03 12:38:20 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 12:38:20 2015 TLS Error: TLS handshake failed
Mon Aug 03 12:38:20 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 12:38:22 2015 UDPv4 link local (bound): [undef]
Mon Aug 03 12:38:22 2015 UDPv4 link remote: [AF_INET]
Mon Aug 03 12:38:28 2015 VERIFY ERROR: depth=0, error=unsupported certificate purpose: C=test, ST=test, L=test, O=test, emailAddress=test@test.com, CN=test -
Deprecated OpenSSL version on client?
-
What do you mean depreciate OpenSSL? I used OpenVPN in client side.
-
So did this ever work and it just started happening, or you trying to setup openvpn server? Are you using the wizard? What version of pfsense what version of the openvpn client?
I just set this up for another user here that couldn't figure it out.. It takes all of 30 seconds to get openvpn up and running with the wizard.
I would guess from this
"error=unsupported certificate purpose: C=test, ST=test, L=test, O=test, emailAddress=test@test.com, CN=test"That your just trying to set this up and using the web gui cert vs creating a new cert.. You really should go through the wizard, create a new CA for openvpn, create your cert for openvpn with that CA and then create a user cert using that CA.
-
I tried to set up new open vpn server. Yes Im using wizard to setup.
pfsense version: 2.2.4
openvpn version: 1.2.16So you mean that I will use the wizard to create CA and user Cert together with openvpn server?
-
I got this error after using wizard to setup openvpn server.
Tue Aug 04 12:17:47 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Aug 04 12:17:47 2015 TLS Error: TLS handshake failed
Tue Aug 04 12:17:47 2015 SIGUSR1[soft,tls-error] received, process restarting
Tue Aug 04 12:17:49 2015 UDPv4 link local (bound): [undef]
Tue Aug 04 12:17:49 2015 UDPv4 link remote: [AF_INET]122.55.12.162:3880
Tue Aug 04 12:17:53 2015 SIGTERM[hard,] received, process exiting -
openvpn openvpn version: 1.2.16 ???
Huh?? Are you talking about the openvpn export package version? That is not openvpn client.. or the server.. What is the version of the client you are running on your machine? Are you downloading the client that is in the export link?? Looks like that is 2.3.6-Ix03 which should be updated since 2.3.7 has been out for couple of months.
Yes you use the wizard to create a CA, Cert and then using Cert Manager in Pfsense using that CA create a user cert. Then using the client export package you can download the config that has the info needed for the client to install.
I just went over the instructions here
https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_ServerAnd from a quick read over they look to be spot on.
-
I see..the problem is in the pfsense version isn't compatible with openvpn client version. pfsense 2.2.3 is compatible with openvpn 2.3.6..when I update pfsense to 2.2.4., openvpn client didn't work.
As you said their is new version of openvpn client 2.3.7, so how to update openvpn export package since it gives me 2.3.6 of openvpn client?
-
There is nothing saying you have to use the bundled client - just download openvpn from openvpn https://openvpn.net/index.php/open-source/downloads.html
Grab your config from the export client, but I don't buy that client 2.3.6 is not compatible with 2.2.4.. That doesn't make any sense at all.. I could always just run 2.3.6 and test it.. Will do from work.
From your error
error=unsupported certificate purposepoints to using the wrong certs
edit: As I thought I uninstalled my openvpn client (2.3.8 is out btw) and installed the bundled exe from export client, and connected without any issues
Wed Aug 05 07:42:22 2015 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Wed Aug 05 07:42:22 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Wed Aug 05 07:42:24 2015 Control Channel Authentication: using 'pfSense-TCP-443-johnpoz-tls.key' as a OpenVPN static key fileYour issue is not with the client version.
-
Grab your config from the export client, but I don't buy that client 2.3.6 is not compatible with 2.2.4.. That doesn't make any sense at all.. I could always just run 2.3.6 and test it.. Will do from work.
Confirm that.
As I had the same issue with an older OpenSSL version and pfSense 2.2.4, I installed 2.3.6 from the Clien Export utility and it work flawlessly. -
I have 10 openvpn client with same openvpn installer that exported from pfsense and one of them encountered the error stated above (subject) and the rest works fine. I have disable the windows firewall and antivirus but got same error.
Any idea?
-
And validate your using the correct certs.. What part of about "error=unsupported certificate purpose" is not clear??
Are you trying to use a cert marked as server for user?
-
I had the exact same error, using the wizard exactly as I thought I was supposed to. The "invalid purpose" message is really the key here, but it took a while to sink in for me.
Making this worse was the fact that my VPN was working through the iOS OpenVPN app but refused to work through Viscosity or Tunnelblick on Mac.
Make certain that your OpenVPN server is using a "Server cert", and that your user is using a "User Cert".
After I finished the Wizard, my OpenVPN server had been assigned the user cert and it took me like 4 days to catch it. Going into the Cert Manager and creating a fresh server-only cert, and then assigning it to the OpenVPN Server instance fixed this perfectly and Viscosity connected.
-
Not sure what to tell you other than the openvpn wizard doesn't create user certs.. You have to create that in the CA manager after you setup the server.. So not sure what you think you did with the wizard but it doesn't create user certs.
It will create your CA, and then it will create your server cert..
-
In the few times I've posted here, with a question or trying to be helpful (to the other newbs like me) - every single time "experts" come along and make me feel stupid.
This is such an unwelcome forum to be new.
I had created a user cert (yes I know it wasn't done through the wizard) - and I finally figured out that I broke the setup myself by accidentally assigning it to the server. "Invalid purpose" wasn't as clear an error message as people here seem to think it is.
I have no grudge against pfSense and I'm not asking anyone to make any changes based on my experience - just posting a specific fix in a forum against a specific error message.
-
"After I finished the Wizard, my OpenVPN server had been assigned the user cert"
Again dude the Wizard does NOT do that, can not do that!! So if you did that that is on you not the wizard.. Not sure how that could ever happen other than just pure stupidity??
If english is not your native language ""Invalid purpose"" might be a bit confusing, but if you actually speak english how is that not clear??
