Solved VPN fails on Win10 PC and Android devices

[Telos]

Not sure what has happened, as I have no access access via my Win10 or Android users. Today nothing works... just something about expired cert... Here's a partial log that I see...

FWIW, I use LE Cert... still good.

Thu Feb 27 17:40:35 2020 VERIFY ERROR: depth=0, error=certificate has expired: CN=xxxxxxxx.synology.me Thu Feb 27 17:40:35 2020 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed Thu Feb 27 17:40:35 2020 TLS_ERROR: BIO read tls_read_plaintext error Thu Feb 27 17:40:35 2020 TLS Error: TLS object -> incoming plaintext read error Thu Feb 27 17:40:35 2020 TLS Error: TLS handshake failed Thu Feb 27 17:40:35 2020 SIGUSR1[soft,tls-error] received, process restarting Thu Feb 27 17:40:40 2020 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.

Any ideas? This was working 2 weeks ago. Many thanks.

 

[fredbert]

Has the certificate expired and renewal failed? Could be that revocation lists are actually being consulted. Does OpenVPN server cache the certificate and it hasn't loaded the new one?

In the OpenVPN config file is there a parameter that can be set to accept expired certificates, just as a test. One reason I keep SSL-VPN and OpenVPN gateways running is in case one fails. Also, I have a limited (users) access for L2TP as well.

All pure guesses but is where I'd start looking and Googling/DuckDuckGo-ing.

 

[Telos]

Has the certificate expired and renewal failed? Could be that revocation lists are actually being consulted. Does OpenVPN server cache the certificate and it hasn't loaded the new one?

My LE cert doesn't expire until early-May. So this is all puzzling. My last VPN session was on Feb 18.

Your comments about caching got me thinking... so I changed the VPN server default cert to synology.com, and then back to the LE cert. That had no immediate affect. Next, I restarted the NAS (grumble, grumble...) and upon restart VPN access was restored.

So maybe there's now a Synology bug that doesn't update the cert. IDK.

But you got me thinking and for now this is resolved. Thank you.

 

[fredbert]

Certainly sounds like a bug. But one of those difficult to repeat such that it gets fixed anytime soon.

instead of rebooting the whole NAS you could try disabling OpenVPN and then re-enabling it. Or restarting the daemon from CLI.

 

[Rinthe]

Hey guys,

I've tried the default synology certificate, my own self signed certificate and a let's encrypt certificate. None of which is working for me. I'm getting these errors:

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

Any ideas?

 

[Rusty]

Hey guys,

I've tried the default synology certificate, my own self signed certificate and a let's encrypt certificate. None of which is working for me. I'm getting these errors:

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

Any ideas?

You did export the vpn file from your vpn server each time after you have changed your certificate?

 

[Telos]

I've tried the default synology certificate, my own self signed certificate and a let's encrypt certificate. None of which is working for me.

You did export the vpn file from your vpn server each time after you have changed your certificate?

Relatedly, did you check the cert configured for your VPN server through all these changes...