Unable to connect to OpenVPN server in Windows
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello,
I created an OpenVPN server on my router, but when trying to connect to it using OpenVPN client on Windows, I get some weird "certificate verify error".
Using the same opvn profile to connect from Ubuntu on WSL running on the same box, I am able to connect to the router.
Any idea why the cert verification fails only on OpenVPN connect client for Windows?
Thanks!
Lior
OpenVPN client log:
⏎[Mar 28, 2023, 22:31:19] UNUSED OPTIONS
5 [nobind]
8 [resolv-retry] [infinite]
10 [persist-key]
⏎[Mar 28, 2023, 22:31:19] EVENT: RESOLVE ⏎[Mar 28, 2023, 22:31:19] Contacting MY_WAN_IP:1194 via UDP
⏎[Mar 28, 2023, 22:31:19] EVENT: WAIT ⏎[Mar 28, 2023, 22:31:19] WinCommandAgent: transmitting bypass route to MY_WAN_IP
{
"host" : "MY_WAN_IP",
"ipv6" : false
}
⏎[Mar 28, 2023, 22:31:19] Connecting to [MY_WAN_IP]:1194 (MY_WAN_IP) via UDPv4
⏎[Mar 28, 2023, 22:31:19] EVENT: CONNECTING ⏎[Mar 28, 2023, 22:31:19] Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client
⏎[Mar 28, 2023, 22:31:19] Creds: UsernameEmpty/PasswordEmpty
⏎[Mar 28, 2023, 22:31:19] Peer Info:
IV_VER=3.git::d3f8b18b
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-128-CBC
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1
IV_GUI_VER=OCWindows_3.3.7-2979
IV_SSO=webauth,openurl,crtext
⏎[Mar 28, 2023, 22:31:19] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
⏎[Mar 28, 2023, 22:31:19] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
⏎[Mar 28, 2023, 22:31:19] EVENT: DISCONNECTED
⏎[Mar 28, 2023, 22:32:42] OpenVPN core 3.git::d3f8b18b win x86_64 64-bit built on Feb 7 2023 16:08:10
Sure right now DST is disabled and the router time is 1 hour earlier than the actual time.
BTW, maybe I don't get it, but why "date mode" requires to specify a year? DST is yearly.
Check out the screenshot below. You have 3 timestamps here:
1) The filename timestamp - indicating the time of the generation which is 8:53)
2) The certificate timestamp which is 9:53
3) My PC time which is the time of file creation on disk - 9:53
Regardless of the DST setting (which is turned off), you can see that the certificate timestamp is 1 hour later than the actual router's clock (filename vs certificate which are supposed to be the same).
