TLS 1.0 connection fails with OpenVPN 3 core

[richardlawley]

General information

1. Android Version: 12 SPB5.210812.002
2. Android Vendor: Android Beta Program
3. Device: Pixel 5
4. Version of the app: 0.7.28 (play store beta program)

Description of the issue

VPN refuses to connect since one of the updates this week. I use tls-auth with a static key, and certificates are SHA256. This does not seem to match with the similar issues which have been opened that come down to weak ciphers or SHA1 certs.

In the app, the log all gets printed one line at a time, making it quite hard to see what's going on, but by sending the logfile I was able to grab this extract which repeats every 2 seconds:

2021-10-14 08:38:02 Contacting xx.xx.xx.xx:1195 via UDP
2021-10-14 08:38:02 Connecting to [xx.xx.xx.xx]:1195 (xx.xx.xx.xx) via UDPv4
2021-10-14 08:38:02 Tunnel Options:V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client
2021-10-14 08:38:02 Creds: UsernameEmpty/PasswordEmpty
2021-10-14 08:38:02 Peer Info:
IV_VER=3.7_git:master
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:DES-EDE3-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_AUTO_SESS=1
IV_GUI_VER=de.blinkt.openvpn 0.7.28
IV_SSO=openurl,webauth,crtext
2021-10-14 08:38:03 VERIFY OK: depth=1, ************************, signature: RSA-SHA256
2021-10-14 08:38:03 VERIFY OK: depth=0, ************************, signature: RSA-SHA256
2021-10-14 08:38:03 Client exception in transport_recv_excode: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:0A0C0103:SSL routines::internal error
2021-10-14 08:38:03 Client terminated, restarting in 2000 ms...

Able to still connect using OpenVPN Connect. If there's any more information I can provide to assist with this, please let me know.

[schwabe]

Yes. This is indeed something else. The internal OpenSSL error is "interesting". Do you use Certificates from the android keystore? Does switching to the openvpn2 work for you?

[richardlawley]

Switching to openvpn2 did not allow the connection to be made, but did provide better log messages:

TLS error: Unsupported protocol. This typically indicates that client and server have no common TLS version enabled. This can be caused by mismatched tls-version-min and tls-version-max options on client and server. If your OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only

I've verified that the server is running 2.3.2 (which only supported TLS 1.0), so this looks like the cause. I suspect this isn't something you can (or should) fix in the client, but a log hint might be helpful for other people (there may well be multiple causes for "internal error" though).

[schwabe]

Enabling compat-mode with 2.3.0 should lower the minimum required TLS version back to 1.0 again. Out of curiosity: what old device are you running against that uses OpenVPN from 2013?

[richardlawley]

Where do I specify that option, I can't find it?

The old device is a Ubiquiti Edgerouter on an older firmware, which will be upgraded shortly.

[Quip11]

Same here, Ubiquiti Edgerouter running v1.10.11. OpenVPN for Android 0.7.27.

[Quip11]

@richardlawley Do we have to upgrade our Ubiquiti routers to v2.0.9 to support TLS > 1.0?

[richardlawley]

It looks like it, yes. https://community.ui.com/questions/EdgeOS-OpenVPN-version-bump/27c2b020-fba7-4a69-b31f-0bed9c27a95e#answer/960f6ff7-b0d7-42e7-81d3-586bb3d9ffa8

[schwabe]

basic settings of the VPN

[schwabe]

For openvpn3 core you probably also need to enable TLS security settings insecure under Auth/encryption settings of the app and need 0.7.29 of the app (currently in beta track in play store)

[Quip11]

Upgrading my Android app to 0.7.29 you just released and selecting "OpenVPN 2.3.x and older peers" fixed my issues. Now I'd like to know how to fix my EdgeRouter so it uses a newer TLS.