Unable to start openvpn -> sigterm

[sveinhansen]

After pulling down the latest version of the image last weekend, the container fails to start and restart infinite.

I suspect the following log gives an indication of what goes wrong:

VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=GB, ST=LN, L=London, O=vpnsvc, OU=vpnsvc, CN=vpnsvc, name=vpnsvc, [email protected], serial=1
OpenSSL: error:0A000086:SSL routines::certificate verify failed

Full startup log:

Creating TUN device /dev/net/tun
Using OpenVPN provider: ANONINE
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for ANONINE. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.i7jgkbuPbC
Extracting configs to /tmp/tmp.qawPALvETl
Found configs for ANONINE in /tmp/tmp.qawPALvETl/vpn-configs-contrib-main/openvpn/anonine, will replace current content in /etc/openvpn/anonine
Cleanup: deleting /tmp/tmp.i7jgkbuPbC and /tmp/tmp.qawPALvETl
Starting OpenVPN using config Sweden-Stockholm.ovpn
Modifying /etc/openvpn/anonine/Sweden-Stockholm.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
 Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 10.0.0.0/24 via 172.28.0.1 dev eth0
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 14 2022
library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xx.46.73:1195
Socket Buffers: R=[131072->131072] S=[16384->16384]
Attempting to establish TCP connection with [AF_INET]xxx.xx.46.73:1195 [nonblock]
TCP connection established with [AF_INET]xxx.xx.46.73:1195
TCP_CLIENT link local: (not bound)
TCP_CLIENT link remote: [AF_INET]xxx.xx.46.73:1195
TLS: Initial packet from [AF_INET]xxx.xx.46.73:1195, sid=e52156a6 746749b3
VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=GB, ST=LN, L=London, O=vpnsvc, OU=vpnsvc, CN=vpnsvc, name=vpnsvc, [email protected], serial=1
OpenSSL: error:0A000086:SSL routines::certificate verify failed
TLS_ERROR: BIO read tls_read_plaintext error
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
Fatal TLS error (check_tls_errors_co), restarting
SIGTERM[soft,tls-error] received, process exiting

Any help is appreciated! In advance, thanks!

-s

[pkishino]

#2434

[sveinhansen]

Thanks.