1 Temat przez badziewiak (edytowany przez badziewiak 2026-06-08 08:49:31)

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Temat: Gargoyle 1.15.0.5 problem z openvpn

Witam
Mam problem ze wszystkimi klientami openvpn. Udało mi się połączyć przez wireguard, dlatego mogłem odczytać logi routera:

Mon Jun  8 09:40:11 2026 daemon.notice openvpn(custom_config)[15305]: 46.134.143.137:30146 SIGUSR1[soft,tls-error] received, client-instance restarting
Mon Jun  8 09:40:13 2026 daemon.notice openvpn(custom_config)[15305]: TCP connection established with [AF_INET]188.117.149.2:53357
Mon Jun  8 09:40:13 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53357 TLS: Initial packet from [AF_INET]188.117.149.2:53357, sid=3a2babd8 fa48754d
Mon Jun  8 09:40:13 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53357 VERIFY SCRIPT OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:13 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53357 VERIFY OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:13 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53357 VERIFY ERROR: depth=0, subject=CN=rkuci, emailAddress=rkuci@ttopjukgwhetrni.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??, serial=2: The CRL is expired
Mon Jun  8 09:40:13 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53357 TLS_ERROR: read tls_read_plaintext error: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
Mon Jun  8 09:40:13 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53357 TLS Error: TLS object -> incoming plaintext read error
Mon Jun  8 09:40:13 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53357 TLS Error: TLS handshake failed
Mon Jun  8 09:40:13 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53357 Fatal TLS error (check_tls_errors_co), restarting
Mon Jun  8 09:40:13 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53357 SIGUSR1[soft,tls-error] received, client-instance restarting
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: TCP connection established with [AF_INET]188.117.149.2:53360
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53360 TLS: Initial packet from [AF_INET]188.117.149.2:53360, sid=1eefc975 29f1ac2e
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53360 VERIFY SCRIPT OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53360 VERIFY OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53360 VERIFY ERROR: depth=0, subject=CN=rkuci, emailAddress=rkuci@ttopjukgwhetrni.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??, serial=2: The CRL is expired
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53360 TLS_ERROR: read tls_read_plaintext error: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53360 TLS Error: TLS object -> incoming plaintext read error
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53360 TLS Error: TLS handshake failed
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53360 Fatal TLS error (check_tls_errors_co), restarting
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53360 SIGUSR1[soft,tls-error] received, client-instance restarting
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: TCP connection established with [AF_INET]46.134.143.137:10154
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 46.134.143.137:10154 TLS: Initial packet from [AF_INET]46.134.143.137:10154, sid=580772da 330719bd
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 46.134.143.137:10154 VERIFY SCRIPT OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 46.134.143.137:10154 VERIFY OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 46.134.143.137:10154 VERIFY ERROR: depth=0, subject=CN=minipc_robota, emailAddress=minipc_robota@gpsfpzumshigoto.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??, serial=4: The CRL is expired
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 46.134.143.137:10154 TLS_ERROR: read tls_read_plaintext error: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 46.134.143.137:10154 TLS Error: TLS object -> incoming plaintext read error
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 46.134.143.137:10154 TLS Error: TLS handshake failed
Mon Jun  8 09:40:15 2026 daemon.err openvpn(custom_config)[15305]: 46.134.143.137:10154 Fatal TLS error (check_tls_errors_co), restarting
Mon Jun  8 09:40:15 2026 daemon.notice openvpn(custom_config)[15305]: 46.134.143.137:10154 SIGUSR1[soft,tls-error] received, client-instance restarting
Mon Jun  8 09:40:17 2026 daemon.notice openvpn(custom_config)[15305]: TCP connection established with [AF_INET]188.117.149.2:53361
Mon Jun  8 09:40:17 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53361 TLS: Initial packet from [AF_INET]188.117.149.2:53361, sid=2a51e26a d1f32e9f
Mon Jun  8 09:40:17 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53361 VERIFY SCRIPT OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:17 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53361 VERIFY OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:17 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53361 VERIFY ERROR: depth=0, subject=CN=rkuci, emailAddress=rkuci@ttopjukgwhetrni.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??, serial=2: The CRL is expired
Mon Jun  8 09:40:17 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53361 TLS_ERROR: read tls_read_plaintext error: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
Mon Jun  8 09:40:17 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53361 TLS Error: TLS object -> incoming plaintext read error
Mon Jun  8 09:40:17 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53361 TLS Error: TLS handshake failed
Mon Jun  8 09:40:17 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53361 Fatal TLS error (check_tls_errors_co), restarting
Mon Jun  8 09:40:17 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53361 SIGUSR1[soft,tls-error] received, client-instance restarting
Mon Jun  8 09:40:19 2026 daemon.notice openvpn(custom_config)[15305]: TCP connection established with [AF_INET]188.117.149.2:53367
Mon Jun  8 09:40:19 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53367 TLS: Initial packet from [AF_INET]188.117.149.2:53367, sid=e232c57c 9348145e
Mon Jun  8 09:40:19 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53367 VERIFY SCRIPT OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:19 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53367 VERIFY OK: depth=1, CN=Easy-RSA CA, emailAddress=uqqoapxqlvwqfch@qishrmktqbfohhe.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??
Mon Jun  8 09:40:19 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53367 VERIFY ERROR: depth=0, subject=CN=rkuci, emailAddress=rkuci@ttopjukgwhetrni.com, O=UnknownOrg, OU=UnknownOrgUnit, L=UnknownCity, ST=UnknownProvince, C=??, serial=2: The CRL is expired
Mon Jun  8 09:40:19 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53367 TLS_ERROR: read tls_read_plaintext error: X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
Mon Jun  8 09:40:19 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53367 TLS Error: TLS object -> incoming plaintext read error
Mon Jun  8 09:40:19 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53367 TLS Error: TLS handshake failed
Mon Jun  8 09:40:19 2026 daemon.err openvpn(custom_config)[15305]: 188.117.149.2:53367 Fatal TLS error (check_tls_errors_co), restarting
Mon Jun  8 09:40:19 2026 daemon.notice openvpn(custom_config)[15305]: 188.117.149.2:53367 SIGUSR1[soft,tls-error] received, client-instance restarting
Success

Sztuczna menda na podstawie logów klienta podpowiada, że jest błąd implementacji generowania certyfikatów i muszę wygenerować ponownie certyfikaty z poziomu serwera. Ja jednak biorę poprawkę na jej wypociny i wolę się upewnić u specjalisty.

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,333

Odp: Gargoyle 1.15.0.5 problem z openvpn

I ma rację. Dla weryfikacji zrób

openssl crl -in crl.pem -text -noout

I zobacz, pewnie data wygasła. Albo generujesz nowe certyfikaty albo generujesz nowy clr - easyrsa gen-crl z tego co pamiętam.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.15.0.5 problem z openvpn

Wywaliłem wszystkie certyfikaty z gui gargoyle, następnie wywaliłem folder /etc/openvpn. Podstawowa konfiguracja klientów i serwera zachowała się w plikach gargoyle, więc zapisanie w web-gui spowodowało wygenerowanie nowych certyfikatów. Działa jak trzeba. Tylko pytanie, czy po roku znowu coś się wyłoży, czy już jest to w samym gargoyle zrobione jak trzeba...

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,333

Odp: Gargoyle 1.15.0.5 problem z openvpn

Powinien ci wygenerować przynajmniej do 2038 roku. Sprawdź.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona