Unable to connect a client to OpenVPN pfsense 2.3

emel_punk

I am trying to configure users to get connection to my office, but no matter how I do it I get the error


Mon Apr 25 11:07:01 2016 OpenVPN 2.3.2 x86_64-mandriva-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Feb  9 2014
Mon Apr 25 11:07:01 2016 WARNING: file 'key.key' is group or others accessible
Mon Apr 25 11:07:01 2016 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.X:1194 [nonblock]
Mon Apr 25 11:07:02 2016 TCP connection established with [AF_INET]XXX.XXX.XXX.X:1194
Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link local (bound): [undef]
Mon Apr 25 11:07:02 2016 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.X:1194
Mon Apr 25 11:07:02 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: C=CO, ST=bogota, L=bogota, O=mdc, emailAddress=info@mdc.com.co, CN=internal-ca
Mon Apr 25 11:07:02 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mon Apr 25 11:07:02 2016 TLS Error: TLS object -> incoming plaintext read error
Mon Apr 25 11:07:02 2016 TLS Error: TLS handshake failed
Mon Apr 25 11:07:02 2016 Fatal TLS error (check_tls_errors_co), restarting
Mon Apr 25 11:07:02 2016 SIGUSR1[soft,tls-error] received, process restarting
^CMon Apr 25 11:07:04 2016 SIGINT[hard,init_instance] received, process exiting

I am not using TLS, but the shared key export tool, include the line tls-auth ta.key no matter what so I disable it on the client config file. If I use tls on the server config settings doesn't work either. This has never happened to me before I have been using it for a long time but now I am creating a new server so I downloaded the latest version and then upgraded to 2.3.

Any ideas?

johnpoz

so you want road warriors to connect to your pfsense machine running openvpn.. did you run through the wizard.. Getting a openvpn server up and running is really a hand full of clicks.. Wizard walks you through the process.

More than likely you have the wrong cert setup.

Your clients are using a very old version of openvpn btw… 2.3.2 was like 2013..

hedi

Hello,

you must check your CA, it must be a server certification and the other one a user certification.

johnpoz

Running through the wizard pretty much makes it impossible to mess up… You create the CA, then the server cert, etc..

emel_punk

It does not work with the wizard either, so it's kind of weird…

Pippin

No one read/notice this error?

VERIFY ERROR: depth=1, error=certificate is not yet valid:

Check your certificates, date, time.

johnpoz

Your clients have the wrong certs from your openvpn config then? As I mentioned before your clients are quite OLD.. 2.3.2 is very OLD client…

How are you configuring the client?? Do you have access to your key file?

"11:07:01 2016 WARNING: file 'key.key' is group or others accessible"

emel_punk

The certs dates are


Valid From: Thu, 28 Apr 2016 12:59:10 -0500
Valid Until: Sun, 26 Apr 2026 12:59:10 -0500

I download the Viscosity files from the client export and run "openvpn config.conf" as I have been doing before. :'(

Pippin

You start this thread on April 25, 2016, 06:09:56 pm and your certificate is
Valid From: Thu, 28 Apr 2016 12:59:10 -0500

Maybe today you will be lucky :)

johnpoz

"error=certificate is not yet valid"

good catch.. So your time on your pfsense is OFF would seem, if you ran through the wizard and created those dates..

emel_punk

Dude I have erased and created the certs a lot, the last time was today….

Pippin

The log message you posted…. never mind.

I also see version 2.3.2 eurephia version, try the latest if possible, dude

emel_punk

guys, i have recorded what I do to configure so please check out here and tell me what I am doing wrong.

Youtube Video

johnpoz

I tried watching that.. its horrific… Why don't you just take some screen shots, and post them?? Vs that up and down, its so freaking blurry can not even tell what your doing..

Why are you trying to use the viscosity config in a linux client?

viscosity.png_thumb

Pippin

Almost 3 years… ;)

emel_punk

Sorry to all, but my problem was not the version… I had my timezone set to "Universal", so the error=certificate is not yet valid was the mismatch between the server and my computer's time

Both versions of openvpn 2.3.2 and 2.3.10 now work fine.

Thank you to all you people.

One last question, where do I put a label to the post as resolved?

divsys

Go to your first posted message and click "Modify", change the title to add "[Solved]".

johnpoz

Being in different timezones is not a problem.. But having the wrong time while your in a timezone sure going to have a problem ;)

Why you should always sync off ntp ;) Which set your time correct for the timezone your in..

But you still have a really OLD client, why would you not updated that… But maybe its because your running on a linux distro that last update was what 2011?