Unable to connect a client to OpenVPN pfsense 2.3

  • I am trying to configure users to get connection to my office, but no matter  how I do it I get the error

    Mon Apr 25 11:07:01 2016 OpenVPN 2.3.2 x86_64-mandriva-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Feb  9 2014
    Mon Apr 25 11:07:01 2016 WARNING: file 'key.key' is group or others accessible
    Mon Apr 25 11:07:01 2016 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.X:1194 [nonblock]
    Mon Apr 25 11:07:02 2016 TCP connection established with [AF_INET]XXX.XXX.XXX.X:1194
    Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link local (bound): [undef]
    Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.X:1194
    Mon Apr 25 11:07:02 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: C=CO, ST=bogota, L=bogota, O=mdc, emailAddress=info@mdc.com.co, CN=internal-ca
    Mon Apr 25 11:07:02 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
    Mon Apr 25 11:07:02 2016 TLS Error: TLS object -> incoming plaintext read error
    Mon Apr 25 11:07:02 2016 TLS Error: TLS handshake failed
    Mon Apr 25 11:07:02 2016 Fatal TLS error (check_tls_errors_co), restarting
    Mon Apr 25 11:07:02 2016 SIGUSR1[soft,tls-error] received, process restarting
    ^CMon Apr 25 11:07:04 2016 SIGINT[hard,init_instance] received, process exiting

    I am not using TLS, but the shared key export tool, include the line tls-auth ta.key no matter what so I disable it on the client config  file. If I use tls on the server config settings doesn't work either. This has never happened to me before I have been using it for a long time but now I am creating a new server so I downloaded the latest version and then upgraded to 2.3.

    Any ideas?

  • LAYER 8 Global Moderator

    so you want road warriors to connect to your pfsense machine running openvpn.. did you run through the wizard.. Getting a openvpn server up and running is really a hand full of clicks..  Wizard walks you through the process.

    More than likely you have the wrong cert setup.

    Your clients are using a very old version of openvpn btw… 2.3.2 was like 2013..

  • Hello,

    you must check your CA, it must be a server certification and the other one a user certification.

  • LAYER 8 Global Moderator

    Running through the wizard pretty much makes it impossible to mess up… You create the CA, then the server cert, etc..

  • It does not work with the wizard either, so it's kind of weird…

  • No one read/notice this error?

    VERIFY ERROR: depth=1, error=certificate is not yet valid:

    Check your certificates, date, time.

  • LAYER 8 Global Moderator

    Your clients have the wrong certs from your openvpn config then?  As I mentioned before your clients are quite OLD.. 2.3.2 is very OLD client…

    How are you configuring the client??  Do you have access to your key file?

    "11:07:01 2016 WARNING: file 'key.key' is group or others accessible"

  • The certs dates are

    Valid From: Thu, 28 Apr 2016 12:59:10 -0500
    Valid Until: Sun, 26 Apr 2026 12:59:10 -0500 	

    I download the Viscosity files from the client export and run "openvpn config.conf" as I have been doing before.  :'(

  • You start this thread on April 25, 2016, 06:09:56 pm and your certificate is
    Valid From: Thu, 28 Apr 2016 12:59:10 -0500

    Maybe today you will be lucky  :)

  • LAYER 8 Global Moderator

    "error=certificate is not yet valid"

    good catch.. So your time on your pfsense is OFF would seem, if you ran through the wizard and created those dates..

  • Dude I have erased and created the certs a lot, the last time was today….

  • The log message you posted…. never mind.

    I also see version 2.3.2 eurephia version, try the latest if possible, dude

  • guys, i have recorded what I do to configure so please check out here and tell me what I am doing wrong.

    Youtube Video

  • LAYER 8 Global Moderator

    I tried watching that.. its horrific… Why don't you just take some screen shots, and post them??  Vs that up and down, its so freaking blurry can not even tell what your doing..

    Why are you trying to use the viscosity config in a linux client?

  • Almost 3 years… ;)

  • Sorry to all, but my problem was not the version… I had my timezone set to "Universal", so the  error=certificate is not yet valid was the mismatch between the server and my computer's time

    Both versions of openvpn 2.3.2 and 2.3.10 now work fine.

    Thank you to all you people.

    One last question, where do I put a label to the post as resolved?

  • Go to your first posted message and click "Modify", change the title to add "[Solved]".

  • LAYER 8 Global Moderator

    Being in different timezones is not a problem..  But having the wrong time while your in a timezone sure going to have a problem ;)

    Why you should always sync off ntp ;)  Which set your time correct for the timezone your in..

    But you still have a really OLD client, why would you not updated that… But maybe its because your running on a linux distro that last update was what 2011?

Log in to reply