I caot coect to the VPN server using openvpn.
$ openvpn --version
OpenVPN 2.4.2 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 11 2017
library versions: OpenSSL 1.1.0e 16 Feb 2017, LZO 2.10
The openvpn output:
$ openvpn --config /etc/openvpn/TCP/Netherlands1-tcp.ovpn
Sun May 14 21:16:58 2017 WARNING: file '/etc/openvpn/Wdc.key' is group or others accessible
Sun May 14 21:16:58 2017 WARNING: file '/etc/openvpn/auth-user-pass' is group or others accessible
Sun May 14 21:16:58 2017 OpenVPN 2.4.2 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 11 2017
Sun May 14 21:16:58 2017 library versions: OpenSSL 1.1.0e 16 Feb 2017, LZO 2.10
Sun May 14 21:16:58 2017 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun May 14 21:16:58 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:80
Sun May 14 21:16:58 2017 Attempting to establish TCP coection with [AF_INET]xx.xx.xx.xx:80 [nonblock]
Sun May 14 21:16:59 2017 TCP coection established with [AF_INET]xx.xx.xx.xx:80
Sun May 14 21:16:59 2017 TCP_CLIENT link local: (not bound)
Sun May 14 21:16:59 2017 TCP_CLIENT link remote: [AF_INET]xx.xx.xx.xx:80
Sun May 14 21:16:59 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun May 14 21:16:59 2017 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=HK, ST=HK, L=HongKong, O=PureVPN, OU=IT, CN=PureVPN, name=PureVPN, [email protected]
Sun May 14 21:16:59 2017 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Sun May 14 21:16:59 2017 TLS_ERROR: BIO read tls_read_plaintext error
Sun May 14 21:16:59 2017 TLS Error: TLS object -> incoming plaintext read error
Sun May 14 21:16:59 2017 TLS Error: TLS handshake failed
Sun May 14 21:16:59 2017 Fatal TLS error (check_tls_errors_co), restarting
Sun May 14 21:16:59 2017 SIGUSR1[soft,tls-error] received, process restarting
^CSun May 14 21:17:00 2017 SIGINT[hard,init_instance] received, process exiting
The VPN Provider is PureVPN and what I believe I got by now is that the ca hash algorithm is too weak .. does this mean my openvpn client doesn't accept the servers certificate? Can I somehow allow weak algorithms to be used or is the error something completely different?
This is the openvpn config file:
$ cat TCP/Netherlands1-tcp.ovpn
client
dev tun
proto tcp
remote ab.cd.com 80
persist-key
persist-tun
ca ca.crt
tls-auth Wdc.key 1
cipher AES-256-CBC
comp-lzo
verb 1
mute 20
route-method exe
route-delay 2
route 0.0.0.0 0.0.0.0
float
auth-user-pass
auth-retry interact
ifconfig-nowarn
script-security 2
ca /etc/openvpn/ca.crt
tls-auth /etc/openvpn/Wdc.key 1
auth-user-pass /etc/openvpn/auth-user-pass
Thanks for any help!