OVPN Functionality Broken - peer certificate verification failure

[Dejavou42]

I was previously using softether alongside ovpn profiles to connect via android / iphone. I have been having issues going back to November 2023 with ovpn reporting "peer certificate verification failure."

What I have tried:

1. Upgraded softether VPN to version 4.43

2. Issued new certificates (both self signed and then signed by a CA). I imported these into the "Encryption and network" menu, and then issued new ovpn profiles / checked to make sure the correct cert was included in that profile. The same error persisted.

3. Changed the encryption method to AES256-GCM-SHA384 under Encryption Algorithm Name. I also updated the ovpn profile to:

Code: Select all

cipher AES-256-CBC
auth SHA384
 

The same error persists with this change.

Here is the error log from Open VPN.

Code: Select all

⏎[Jan 30, 2024, 10:10:11] Connecting to [xxxxxx.xxxx]:1194 (xxx.xxx.xxx.xxx) via UDP
⏎[Jan 30, 2024, 10:10:11] EVENT: CONNECTING ⏎[Jan 30, 2024, 10:10:11] Tunnel Options:V4,dev-type tun,link-mtu 1585,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA384,keysize 256,key-method 2,tls-client
⏎[Jan 30, 2024, 10:10:11] Creds: Username/Password
⏎[Jan 30, 2024, 10:10:11] Sending Peer Info:
IV_VER=3.8.2connect3
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=990
IV_MTU=1600
IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_GUI_VER=OCWindows_3.4.3-3337
IV_SSO=webauth,crtext

⏎[Jan 30, 2024, 10:10:12] Transport Error: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2640 status=-1: error:0A000086:SSL routines::certificate verify failed
⏎[Jan 30, 2024, 10:10:12] EVENT: CERT_VERIFY_FAIL OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2640 status=-1: error:0A000086:SSL routines::certificate verify failed⏎[Jan 30, 2024, 10:10:12] EVENT: DISCONNECTED ⏎

The connection works fine for the softether vpn client on a PC.

Can anyone help with this issue?

[solo]

Check connections to https://www.vpngate.net/en/howto_openvpn.aspx#android

Try:

CLIENT
data-ciphers AES-128-CBC
auth SHA1

SERVER
in "Encryption Algorithm Name" select "AES128-SHA"

[Dejavou42]

I appreciate the response solo. My issue was caused by a conflict with the vpn server on the router which takes priority over the port forwarding that was set up. I changed ports for the softether vpn server and this resolved my issue.