OpenSSL error while connecting

[v.pank...@gmail.com]

Hey guys,

first post here, sorry if I miss some inside joke.

So basically what happened, I suddenly started getting errors like this:

OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Nothing changed on server side and nothing changed on client side. Other than maybe brew updated open ssl (there was new version). What could be the problem?

Thanks!

[jkbull...gmail.com]

OpenSSL error messages are cryptic.

Tunnelblick uses its own copy of the OpenSSL library; it does not use the OS X copy or any Brew copies, so if you didn't update Tunnelblick or the server, the only thing I can think of is that one or more of the certificates expired.

If you updated Tunnelblick, it could be that the new version of OpenSSL library in the new version of Tunnelblick requires larger keys. I don't recall the details, but in the last year or two the minimum acceptable length of certain types of keys that OpenSSL accepts changed from 512 bits to 768 bits, and then I think to 1024 bits. You'd have to consult the OpenSSL change log. You can see the version of the OpenSSL library that Tunnelblick uses in the VPN log; here is a sample with the OpenSSL version highlighted:

2016-07-05 14:50:11 OpenVPN 2.3_git_ec0c1dc x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH] [IPv6] built on Jul  3 2016

2016-07-05 14:50:11 library versions: OpenSSL 1.0.2h  3 May 2016, LZO 2.09

It might help if you posted the info obtained by following the instructions at Read Before You Post.

[mgmm...@gmail.com]

I have same problem since update to Mac os X 10.11.4...

2016-07-19 16:10:42 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2016-07-19 16:10:42 TLS_ERROR: BIO read tls_read_plaintext error

2016-07-19 16:10:42 TLS Error: TLS object -> incoming plaintext read error

2016-07-19 16:10:42 TLS Error: TLS handshake failed

cheers mgmmodel

[Vilius Pankauskas]

I solved it. Turns out it's the newest Tunnelblick that causes the problems. Just downgrade a version or two and everything works fine.

[jkbull...gmail.com]

On Tuesday, July 19, 2016 at 10:19:17 AM UTC-4, <> wrote:

I have same problem since update to Mac os X 10.11.4...

You have the same problem, so I have the same answer:

https://groups.google.com/d/msg/tunnelblick-discuss/1eKCT9vJETk/AIC4Ms6_BQAJ

[jkbull...gmail.com]

On Tuesday, July 19, 2016 at 10:24:42 AM UTC-4, Vilius Pankauskas wrote:

I solved it. Turns out it's the newest Tunnelblick that causes the problems. Just downgrade a version or two and everything works fine.

Using an old version of Tunnelblick is not a good idea. Tunnelblick updates contain updated versions of OpenSSL, so if you don't update, you don't get the updated OpenSSL and you are vulnerable to various attacks.

The problem both of you are likely to have is that you are using cryptographic keys that are too small. Recent versions of OpenSSL contain fixes for security vulnerabilities, and require 768-bit keys (I think the latest versions require 1024-bit keys).When you use a version of Tunnelblick with a recent version of OpenSSL, it won't let you connect using smaller keys as a safety measure. (Short keys have been shown to be vulnerable to attack, which is why larger keys are now required.)

 

[jkbull...gmail.com]

Since neither Vilius Pankauskas nor mgmmodel have provided any of the information I asked about, or any information about their VPN setup at all, I have no way of knowing if the problem they have is the key length problem, and I can't be more specific about a solution.

The solution to the problem of keys being too short is to generate new keys and use them. For that, talk to the person that set up your VPN, or your VPN service provider, if you have one. If you are connecting to a VPN created by your home router, for example, get updated firmware for it and use the updated firmware to generate new keys.

[jkbull...gmail.com]

(Mgmmodel wrote to me privately; I do not usually reply privately and instead post publicly.)

I'm not sure I understand – if "all is working", what is the problem you are having?

Your Asus router does not have the latest version of OpenSSL, as can be seen here:

here is ASUS LOG:

Jul 19 17:53:20 openvpn[5007]: OpenVPN 2.3.10 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 20 2016

Jul 19 17:53:20 openvpn[5007]: library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

The current version of OpenSSL is 1.0.2h. See OpenSSL's May 3, 2016 Security Advisory for details about vulnerabilities fixed in 1.0.2h.

It is possible that none of the vulnerabilities affect your router because of the way it uses OpenSSL, but that's hard to know, so I think you should install updated firmware for your router if it is available; if not, complain to Asus.

[mgmm...@gmail.com]

We are talking about TunnelBlick - that is not working 

MAC: OpenSSL 0.9.8zh 14 Jan 2016

but same config is working with Asus router. The question was how to fix Tunnelblick because is not working in latest 2 versions of Apple MAC OS X.

Second question could be - Why...

 TLS Error: TLS handshake failed

OpenSSL 1.0.2g  Funny - IS working because is old.

i have just upgraded Asus router to: 

Jul 19 19:01:58 openvpn[917]: OpenVPN 2.3.10 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 10 2016

Jul 19 19:01:58 openvpn[917]: library versions: OpenSSL 1.0.2h  3 May 2016, LZO 2.08

and is working... so one your theory we can kick-out.

[jkbull...gmail.com]

Regenerate your keys and try with the new keys.

I assume you do that on the Asus router and then transfer them to your Tunnelblick configuration; consult your Asus documentation to find out.

You have still not provided the diagnostic info that I wrote about on July 5:

It might help if you posted the info obtained by following the instructions at Read Before You Post.

[mgmm...@gmail.com]

Forget about my router... it was only  proof that you were wrong...

i have regenerated SSL keys and still the same problem - i have 3 macs so this is not my machine problem its GLOBAL problem.

Tomorrow i'll try to test next vpn provider. Viscosity is working ok. 

Fresh log:

*Tunnelblick: OS X 10.11.6; Tunnelblick 3.6.5 (build 4566)

2016-07-19 19:14:52 *Tunnelblick: Attempting connection with Switzerland using shadow copy; Set nameserver = 769; monitoring connection

2016-07-19 19:14:52 *Tunnelblick: openvpnstart start Switzerland.tblk 1338 769 0 1 0 1065264 -ptADGNWradsgnw 2.3.11

2016-07-19 19:14:52 *Tunnelblick: openvpnstart log:

     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

     

          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.11/openvpn

          --daemon

          --log

          /Library/Application Support/Tunnelblick/Logs/-SUsers-SKKD-SLibrary-SApplication Support-STunnelblick-SConfigurations-SSwitzerland.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1338.openvpn.log

          --cd

          /Library/Application Support/Tunnelblick/Users/KKD/Switzerland.tblk/Contents/Resources

          --verb

          3

          --config

          /Library/Application Support/Tunnelblick/Users/KKD/Switzerland.tblk/Contents/Resources/config.ovpn

          --verb

          3

          --cd

          /Library/Application Support/Tunnelblick/Users/KKD/Switzerland.tblk/Contents/Resources

          --management

          127.0.0.1

          1338

          --management-query-passwords

          --management-hold

          --script-security

          2

          --up

          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

          --down

          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2016-07-19 19:14:52 *Tunnelblick: Established communication with OpenVPN

2016-07-19 19:14:52 *Tunnelblick: Obtained VPN username and password from the Keychain

2016-07-19 19:14:52 OpenVPN 2.3.11 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jul 18 2016

2016-07-19 19:14:52 library versions: OpenSSL 1.0.2h  3 May 2016, LZO 2.09

2016-07-19 19:14:52 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1338

2016-07-19 19:14:52 Need hold release from management interface, waiting...

2016-07-19 19:14:52 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1338

2016-07-19 19:14:52 MANAGEMENT: CMD 'pid'

2016-07-19 19:14:52 MANAGEMENT: CMD 'state on'

2016-07-19 19:14:52 MANAGEMENT: CMD 'state'

2016-07-19 19:14:52 MANAGEMENT: CMD 'bytecount 1'

2016-07-19 19:14:52 MANAGEMENT: CMD 'hold release'

2016-07-19 19:14:52 MANAGEMENT: CMD 'username "Auth" "KKD"'

2016-07-19 19:14:52 MANAGEMENT: CMD 'password [...]'

2016-07-19 19:14:52 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2016-07-19 19:14:52 Socket Buffers: R=[131072->131072] S=[131072->131072]

2016-07-19 19:14:52 MANAGEMENT: >STATE:1468948492,RESOLVE,,,

2016-07-19 19:14:52 Attempting to establish TCP connection with [AF_INET]151.236.26.24:993 [nonblock]

2016-07-19 19:14:52 MANAGEMENT: >STATE:1468948492,TCP_CONNECT,,,

2016-07-19 19:14:52 *Tunnelblick: openvpnstart starting OpenVPN

2016-07-19 19:14:53 TCP connection established with [AF_INET]151.236.26.24:993

2016-07-19 19:14:53 TCPv4_CLIENT link local: [undef]

2016-07-19 19:14:53 TCPv4_CLIENT link remote: [AF_INET]151.236.26.24:993

2016-07-19 19:14:53 MANAGEMENT: >STATE:1468948493,WAIT,,,

2016-07-19 19:14:53 MANAGEMENT: >STATE:1468948493,AUTH,,,

2016-07-19 19:14:53 TLS: Initial packet from [AF_INET]151.236.26.24:993, sid=b8d76ba4 30ec58ff

2016-07-19 19:14:53 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2016-07-19 19:14:53 TLS_ERROR: BIO read tls_read_plaintext error

2016-07-19 19:14:53 TLS Error: TLS object -> incoming plaintext read error

2016-07-19 19:14:53 TLS Error: TLS handshake failed

2016-07-19 19:14:53 Fatal TLS error (check_tls_errors_co), restarting

2016-07-19 19:14:53 SIGUSR1[soft,tls-error] received, process restarting

2016-07-19 19:14:53 MANAGEMENT: >STATE:1468948493,RECONNECTING,tls-error,,

2016-07-19 19:14:53 MANAGEMENT: CMD 'hold release'

2016-07-19 19:14:53 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2016-07-19 19:14:53 Socket Buffers: R=[131072->131072] S=[131072->131072]

2016-07-19 19:14:53 MANAGEMENT: >STATE:1468948493,RESOLVE,,,

2016-07-19 19:14:53 Attempting to establish TCP connection with [AF_INET]151.236.26.24:993 [nonblock]

2016-07-19 19:14:53 MANAGEMENT: >STATE:1468948493,TCP_CONNECT,,,

2016-07-19 19:14:54 *Tunnelblick: Obtained VPN username and password from the Keychain

2016-07-19 19:14:54 TCP connection established with [AF_INET]151.236.26.24:993

2016-07-19 19:14:54 TCPv4_CLIENT link local: [undef]

2016-07-19 19:14:54 TCPv4_CLIENT link remote: [AF_INET]151.236.26.24:993

2016-07-19 19:14:54 MANAGEMENT: >STATE:1468948494,WAIT,,,

2016-07-19 19:14:54 MANAGEMENT: >STATE:1468948494,AUTH,,,

2016-07-19 19:14:54 TLS: Initial packet from [AF_INET]151.236.26.24:993, sid=4295c55c 8c760d5f

2016-07-19 19:14:54 MANAGEMENT: CMD 'username "Auth" "KKD"'

2016-07-19 19:14:54 MANAGEMENT: CMD 'password [...]'

2016-07-19 19:14:54 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2016-07-19 19:14:54 TLS_ERROR: BIO read tls_read_plaintext error

2016-07-19 19:14:54 TLS Error: TLS object -> incoming plaintext read error

2016-07-19 19:14:54 TLS Error: TLS handshake failed

2016-07-19 19:14:54 Fatal TLS error (check_tls_errors_co), restarting

2016-07-19 19:14:54 SIGUSR1[soft,tls-error] received, process restarting

2016-07-19 19:14:54 MANAGEMENT: >STATE:1468948494,RECONNECTING,tls-error,,

2016-07-19 19:14:54 MANAGEMENT: CMD 'hold release'

2016-07-19 19:14:54 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2016-07-19 19:14:54 Socket Buffers: R=[131072->131072] S=[131072->131072]

2016-07-19 19:14:54 MANAGEMENT: >STATE:1468948494,RESOLVE,,,

2016-07-19 19:14:54 Attempting to establish TCP connection with [AF_INET]151.236.26.24:993 [nonblock]

2016-07-19 19:14:54 MANAGEMENT: >STATE:1468948494,TCP_CONNECT,,,

2016-07-19 19:14:55 *Tunnelblick: Obtained VPN username and password from the Keychain

2016-07-19 19:14:55 TCP connection established with [AF_INET]151.236.26.24:993

2016-07-19 19:14:55 TCPv4_CLIENT link local: [undef]

2016-07-19 19:14:55 TCPv4_CLIENT link remote: [AF_INET]151.236.26.24:993

2016-07-19 19:14:55 MANAGEMENT: >STATE:1468948495,WAIT,,,

2016-07-19 19:14:55 MANAGEMENT: >STATE:1468948495,AUTH,,,

2016-07-19 19:14:55 TLS: Initial packet from [AF_INET]151.236.26.24:993, sid=5f1d8d84 390aca20

2016-07-19 19:14:55 MANAGEMENT: CMD 'username "Auth" "KKD"'

2016-07-19 19:14:55 MANAGEMENT: CMD 'password [...]'

2016-07-19 19:14:56 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2016-07-19 19:14:56 TLS_ERROR: BIO read tls_read_plaintext error

2016-07-19 19:14:56 TLS Error: TLS object -> incoming plaintext read error

2016-07-19 19:14:56 TLS Error: TLS handshake failed

2016-07-19 19:14:56 Fatal TLS error (check_tls_errors_co), restarting

2016-07-19 19:14:56 SIGUSR1[soft,tls-error] received, process restarting

[mgmm...@gmail.com]

I have updated mac OS OPENSSL

OpenSSL 1.0.2h  3 May 2016

but Tunnelblick is still not working :(((

[Vilius Pankauskas]

It's clear Tunnelblick glitch. I have up to date OpenSSL and the older Tunnelblick version is working fine with it.

By the way, I can't change the server keys, since I do not own them.

--

Vilius P.

[jkbull...gmail.com]

@mgmm...@gmail.com:

Third try:

You have still not provided the diagnostic info that I wrote about on July 5:

It might help if you posted the info obtained by following the instructions at Read Before You Post.

On Tuesday, July 19, 2016 at 1:20:34 PM UTC-4, <> wrote:

Forget about my router... it was only  proof that you were wrong...

i have regenerated SSL keys and still the same problem - i have 3 macs so this is not my machine problem its GLOBAL problem.

Tomorrow i'll try to test next vpn provider. Viscosity is working ok. 

Fresh log:

I asked for the diagnostic info, not the log.

[jkbull...gmail.com]

The OS X copy of OpenSSL has nothing to do with it. Tunnelblick contains it's own copy of the OpenSSL library and has OpenVPN use that.

[jkbull...gmail.com]

Again: You have still not provided the diagnostic info that I wrote about on July 5:

It might help if you posted the info obtained by following the instructions at Read Before You Post.

[mgmm...@gmail.com]

Hello again:

first of all yesterday I have made my first post here so I don't know why are you still talking about July 5.

Please explain me why "Tunnelblick uses its own copy of the OpenSSL library" it's very suspicious!

I do not know who you work for (NSA / CIA / MOSAD /FSB) but I'll not use any more your Tunnelblick because I haven't compiled your probably tricky OPENSSL and I don't know what is inside !

AS you know there is only few VPN clients on MAC so I think this one in high probability can be compromised.  

OpenSSL is an open source project. SO where is your OPENSSL OPEN ?

[Vilius Pankauskas]

That July 5 was for me. My first post about this was on July 5. 

But again, there's nothing to post, I'm using the older version of Tunnelblick, since I can't enforce the serverside changes.

Though I am quite a bit worried about the "own copy of the OpenSSL library" and agree with mgmmodel. 

Please elaborate on this one.

--

Vilius P.

[jkbull...gmail.com]

Please see my answers below.

On Wednesday, July 20, 2016 at 4:46:51 AM UTC-4, <> wrote:

Hello again:

first of all yesterday I have made my first post here so I don't know why are you still talking about July 5.

I referenced July 5 because that is when I posted my answer to v.pankauskas's question, including my request for info. When you posted yesterday I answered you that because you had the same question, I had the same answer, and provided a link to my July 5 answer.

You have now posted five times without providing the information that I asked for. Of course, I can't force you to provide the information that I want -- the information that you provide is entirely up to you. But I probably won't be able to help solve the problem you are having if you don't provide the information that I ask for.

Please explain me why "Tunnelblick uses its own copy of the OpenSSL library" it's very suspicious!

The primary reason Tunnelblick includes its own copy of OpenSSL is so VPNs can use modern encryption. The old version of OpenSSL that is included in OS X does not include modern encryption suites. Tunnelblick added it's own copy of the OpenSSL library in the Tunnelblick 3.1beta14 release on 2010-09-09. By using OpenSSL 1.0.0a instead of Apple's older version, Tunnelblick added support for 12 message digests, 26 ciphers, and 30 TLS ciphers that Apple's version does not have.

Over the years Tunnelblick has updated the version of OpenSSL that it includes many times, usually releasing a new version of Tunnelblick within days of the release of a new version of OpenSSL. (Most new versions of OpenSSL fix security vulnerabilities, so it is important to get them distributed as soon as possible to protect against attacks based on the vulnerabilities.)

The underlying reason Tunnelblick includes its own copy of OpenSSL is that OS X doesn't support and maintain the copy of OpenSSL that it includes, and OS X doesn't include any version of PolarSSL (now mbedSSL), which is the only other encryption suite that OpenVPN can use. The OpenSSL version supplied in OS X is based on a very old version of OpenSSL (0.9.8), which the OpenSSL organization itself says is "out of support and should not be used".

I do not know who you work for (NSA / CIA / MOSAD /FSB) but I'll not use any more your Tunnelblick because I haven't compiled your probably tricky OPENSSL and I don't know what is inside !

I don't work for any organization; I'm retired and have been developing and maintaining Tunnelblick since 2009, when I took over from the original developer, Angelo Laub.

Don't use Tunnelblick if you don't trust me; that's your prerogative.

But I have a question: do you compile all of the programs that you use? I doubt it -- if you use a Mac, you don't compile OS X. Only a pure "Free Software" system (running on "Free Hardware", I suppose) can be fully trusted. And only, of course, if you have read and understand all of the source code, including the compilers you use to build binaries (see Reflections on Trusting Trust.)

AS you know there is only few VPN clients on MAC so I think this one in high probability can be compromised.

If you mean that because Tunnelblick is a popular OpenVPN client for Macs that it is a valuable target, that's probably true. But simply because it is a target doesn't mean there is a high probability that it can be compromised, just that it has a high probability of being attacked.

I can't guarantee that the NSA/FBI/CIA/Mossad/FSB/etc. haven't broken into my house and inserted malware into my computers, or had my MacBook Pro modified with keylogging hardware or software while it was being shipped from Apple to me. But I consider those possibilities to be unlikely, and carry on assuming they haven't happened.

By the way, it's "Mac", not "MAC". "Mac" is the computer; "MAC" is part of the phrase "Mac address". See https://en.wikipedia.org/wiki/Mac.

 

  OpenSSL is an open source project. SO where is your OPENSSL OPEN ?

As it says on the "Source" tab of our website, "Tunnelblick source code is available on Tunnelblick's GitHub site."

The source code for OpenSSL (and for OpenVPN and the other open source software that Tunnelblick includes) is in the source's "third_party" folder. We use the official .tar.gz source files, and our build process patches some of them with ".diff" files -- which are also included in the third_party folder -- to make them work on OS X and/or work with Tunnelblick.

Detailed instructions for building binaries of Tunnelblick are also included in the source code, in "Building Tunnelblick from Source Code.rtf".

[jkbull...gmail.com]

On Wednesday, July 20, 2016 at 5:19:56 AM UTC-4, Vilius Pankauskas wrote:

That July 5 was for me. My first post about this was on July 5.

Except that I referred mgmmodel to that post when I answered him.

 But again, there's nothing to post, I'm using the older version of Tunnelblick, since I can't enforce the serverside changes.

Without the info I asked for, it is impossible to know if server changes would be necessary. (I can't guarantee that I will be able to provide a definitive answer even if you do provide the info, but I can't provide a good answer without it. Best would be to have info from both the old version of Tunnelblick that works, and the new version that doesn't.)

As I wrote previously, using an old version of Tunnelblick is not a good idea, so if I were you I would try to solve the problem. But that's up to you.

Though I am quite a bit worried about the "own copy of the OpenSSL library" and agree with mgmmodel. 

Please elaborate on this one.

I have.

[jkbull...gmail.com]

Please see below for an amplification and a correction of my earlier post.

On Wed, Jul 20, 2016 at 6:38 AM, <> wrote:

I do not know who you work for (NSA / CIA / MOSAD /FSB) but I'll not use any more your Tunnelblick because I haven't compiled your probably tricky OPENSSL and I don't know what is inside !

I don't work for any organization; I'm retired and have been developing and maintaining Tunnelblick since 2009, when I took over from the original developer, Angelo Laub.

Don't use Tunnelblick if you don't trust me; that's your prerogative.

And don't use Viscosity or any other OpenVPN client software, either unless you've compiled it yourself. Viscosity, for example, is not open source, so you can't compile it. And Viscosity also includes it's own version of the OpenSSL library, for the same reasons that Tunnelblick does.

(It isn't my intention to disparage Viscosity; it's a fine product that many people use. I used it as an example because it another popular OpenVPN client for Macs.)

By the way, it's "Mac", not "MAC". "Mac" is the computer; "MAC" is part of the phrase "Mac address". See https://en.wikipedia.org/wiki/Mac.

"MAC" is part of the phrase "MAC address", not the phrase "Mac address".

[mgmm...@gmail.com]

Mac: (every one probably understood what i had written using MAC so it's not necessary to Wiki every one)

It was a typo on phone - auto-correction. 

OpenSSL 1.0.2h  3 May 2016

OS X 10.11.6

OLD one ?

"But I have a question: do you compile all of the programs that you use? I doubt it -- if you use a Mac, you don't compile OS X. Only a pure "Free Software" system (running on "Free Hardware", I suppose) can be fully trusted. And only, of course, if you have read and understand all of the source code, including the compilers you use to build binaries (see Reflections on Trusting Trust.)"

OpenSSL it's core so have to be compiled.... what is the meaning of the use of encryption software of unknown origin? there should be option to use system / external OpenSSL

Upgrading is very easy... so sorry but it's not explanation for me. Maybe you think that each user is an idiot but it's not true.  Program should have some requirements like 90% of the programs and so.

Your tool is good but too many questions... also it's strange that is NOT working on my 3 Macs. Simple question - WHY ? 

I dont use Visco... it was only test. As i have written i am using Asus router for VPN.

[jkbull...gmail.com]

On Wed, Jul 20, 2016 at 7:43 AM, <> wrote:

OpenSSL 1.0.2h  3 May 2016

OS X 10.11.6

OLD one ?

You installed that yourself! The version of OpenSSL provided in by Apple in OS X 10.11.6 is 0.9.8zh.

Anyone can check their version of the OpenSSL command by typing the following command into /Applications/Utilities/Terminal:

openssl version

"But I have a question: do you compile all of the programs that you use? I doubt it -- if you use a Mac, you don't compile OS X. Only a pure "Free Software" system (running on "Free Hardware", I suppose) can be fully trusted. And only, of course, if you have read and understand all of the source code, including the compilers you use to build binaries (see Reflections on Trusting Trust.)"

OpenSSL it's core so have to be compiled.... what is the meaning of the use of encryption software of unknown origin? there should be option to use system / external OpenSSL

By that logic, OpenVPN is important, too, so that should also be compiled. (A rogue copy of OpenVPN could just pretend to use encryption without using it, thus making whether OpenSSL was compiled moot).

Also your browser, etc. should be compiled, and your OS, too -- as I wrote earlier, you should use only free software compiled on free hardware (with free firmware, including a free CPU chip with free firmware), to be truly safe. Good luck with that!

Using any software of unknown origin is dangerous.

An option to use the system's or other copy of OpenSSL sounds like a nice enhancement to Tunnelblick. Please feel free to write the changes needed for that and send a GitHub pull request.

Upgrading is very easy... so sorry but it's not explanation for me. Maybe you think that each user is an idiot but it's not true.  Program should have some requirements like 90% of the programs and so.

Upgrading OpenSSL certainly isn't easy for Mac users who aren't comfortable with the command line, which is most of them. And OpenSSL regularly releases updates with fixes for security vulnerabilities, do you'll have to keep track of new versions of OpenSSL and update every few months. And if you also maintain your own copies of OpenVPN and Tuntaposx, you'll have to update them, too.

One of Tunnelblick's fundamental goals is to include everything a user needs for a VPN client except encryption and configuration information. We do that so users don't have to install a bunch of other programs to be able to use it.

If you want to offer your own VPN client software that requires its users to install and maintain their own copies of OpenVPN, OpenSSL or mbedSSL, Tuntaposx, and Sparkle, go ahead.

 

Your tool is good but too many questions... also it's strange that is NOT working on my 3 Macs. Simple question - WHY ?

That's only one question (what are the others? I've answered 3000 questions in this discussion group and am happy to answer more) but I admit it is a good one.

One reason Tunnelblick might not be working for you is that you have never provided the information that I have asked for, so I can't look into it in detail, nor can I go beyond generic suggestions such as checking the key length.

I could make other suggestions even without that info but your attitude is so offensive to me (for example, implying that I work for the NSA/CIA/MOSAD/FSB and am providing compromised copies of Tunnelblick -- meaning I'm either incompetent or a blackguard) that I have decided not to help you with your problem. But that doesn't really matter because you have written that "I'll not use any more your Tunnelblick".

I remain willing to try to help anyone else with or without an Asus router. All I ask is that people seeking help provide me with the information I need to help them efficiently.

 I dont use Visco... it was only test. As i have written i am using Asus router for VPN.

Did you compile the firmware that runs on the router? And the compiler that compiled that firmware?

[mgmm...@gmail.com]

Check photo... i've fixed your buggy Tunnelblick and now ALL is working with my OpenSSL... it is only temp solution for vacation.. so i have chosen fastest way..

W dniu wtorek, 5 lipca 2016 20:44:49 UTC+2 użytkownik v.pank...@gmail.com napisał:

[Tunnelblick developer]

Is there some reason you don't want to share your fixes for the bugs?

If you did that, everyone else could also benefit from your work.

[gabriel....@gmail.com]

Hi there,

I'm actually having the exact same problem today with a fresh copy of Tunnelblick on mac OS 10.12.6.

Is there any information on what this last person's solution to the problem was?

I'm trying to access my company's VPN and I was given Tunnelblick and a configuration file. I have my own username and password.

Other colleagues are using the same configuration and it works for them so it must be something on my end.

Any help would be greatly appreciated!

Thanks,

Gabriel

Here's my diagnostic info (Sorry for the looong post):

*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4b (build 4921); prior version 3.7.4a (build 4920); Admin user

git commit 88763bb2b2bfcc7debb3ddc78cdf5a350722717c

Configuration P92 VPN

"Sanitized" condensed configuration file for /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk:

client

dev tun

proto tcp

remote vpn.p92.hu 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ns-cert-type server

verb 3

auth-nocache

tls-client

auth-user-pass

route 10.128.0.0 255.255.0.0

dhcp-option DNS 10.128.32.201

daemon

keepalive 10 120

<ca>

[Security-related line(s) omitted]

</ca>

<cert>

[Security-related line(s) omitted]

</cert>

<key>

[Security-related line(s) omitted]

</key>

================================================================================

Non-Apple kexts that are loaded:

Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>

   64    0 0xffffff7f80fa2000 0x4b000    0x4b000    at.obdev.nke.LittleSnitch (4728) 7AE337EE-7681-3E6C-9D0D-EC608164A6E0 <7 5 4 3 1>

   91    0 0xffffff7f80e29000 0x10000    0x10000    com.usboverdrive.driver.hid (3.3) E22A11CE-9332-3618-AAEF-8ABE6C34C021 <90 42 35 5 4 3>

  119    2 0xffffff7f81a08000 0x261000   0x261000   com.nvidia.web.NVDAResmanTeslaWeb (10.1.8) 290C72B4-B16E-32A9-BFE6-63A3989D9909 <114 107 12 5 4 3 1>

  120    0 0xffffff7f81c73000 0x2a4000   0x2a4000   com.nvidia.web.NVDANV50HalTeslaWeb (10.1.8) EC43A36E-FE9A-3264-8677-89C5E8C9C6C5 <119 12 4 3>

  121    0 0xffffff7f82f0d000 0xbf000    0xbf000    com.nvidia.web.GeForceTeslaWeb (10.1.8) 1AED630C-387F-3DCF-91DE-5CCBF6157E6C <119 114 107 12 7 5 4 3 1>

  128    2 0xffffff7f813bc000 0x638000   0x638000   com.nvidia.web.NVDAResmanWeb (10.1.8) 056B0A38-2FE4-332B-B093-FD39B82164B1 <127 114 107 12 7 5 4 3 1>

  129    0 0xffffff7f81f3c000 0x154000   0x154000   com.nvidia.web.NVDAGK100HalWeb (10.1.8) 1248C465-41C4-3827-BE7E-84B103E589DF <128 12 4 3>

  131    0 0xffffff7f82e15000 0xa3000    0xa3000    com.nvidia.web.GeForceWeb (10.1.8) C0EA4FAC-C445-330B-B1A2-0737578FD224 <130 128 114 107 12 7 5 4 3 1>

  141    0 0xffffff7f81086000 0x2000     0x2000     com.nvidia.CUDA (1.1.0) 4329B052-6C8A-3900-8E83-744487AEDEF1 <4 1>

================================================================================

There are no unusual files in P92 VPN.tblk

================================================================================

Configuration preferences:

-keychainHasUsernameAndPassword = 1

-loadTun = 

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

-lastConnectionSucceeded = 0

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

================================================================================

Program preferences:

launchAtNextLogin = 1

tunnelblickVersionHistory = (

    "3.7.4b (build 4921)",

    "3.7.4a (build 4920)"

)

statusDisplayNumber = 0

lastLaunchTime = 536279514.216854

lastLanguageAtLaunchWasRTL = 0

connectionWindowDisplayCriteria = showWhenConnecting

maxLogDisplaySize = 102400

keyboardShortcutIndex = 1

namedCredentialsThatAllConfigurationsUse = androczkyg

namedCredentialsNames = (

    androczkyg

)

updateCheckAutomatically = 1

NSWindow Frame SettingsSheetWindow = 546 241 829 524 0 0 1920 1177 

NSWindow Frame ConnectingWindow = 754 672 412 297 0 0 1920 1177 

NSWindow Frame SUUpdateAlert = 650 600 620 392 0 0 1920 1177 

detailsWindowFrameVersion = 4921

detailsWindowFrame = {{994, 600}, {920, 468}}

detailsWindowLeftFrame = {{0, 0}, {165, 350}}

detailsWindowViewIndex = 0

detailsWindowConfigurationsTabIdentifier = log

leftNavSelectedDisplayName = P92 VPN

AdvancedWindowTabIdentifier = connectingAndDisconnecting

haveDealtWithOldTunTapPreferences = 1

haveDealtWithOldLoginItem = 1

SUEnableAutomaticChecks = 1

SUScheduledCheckInterval = 86400

SULastCheckTime = 2017-12-29 22:31:55 +0000

SUHasLaunchedBefore = 1

WebKitDefaultFontSize = 16

WebKitStandardFont = Times

================================================================================

Tunnelblick Log:

*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4b (build 4921); prior version 3.7.4a (build 4920)

2017-12-29 23:40:29 *Tunnelblick: Attempting connection with P92 VPN using shadow copy; Set nameserver = 769; monitoring connection

2017-12-29 23:40:29 *Tunnelblick: openvpnstart start P92\ VPN.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.3.18-openssl-1.0.2n

2017-12-29 23:40:30 *Tunnelblick: openvpnstart log:

     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

     

          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.18-openssl-1.0.2n/openvpn

          --daemon

          --log

          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sgabriel-SLibrary-SApplication Support-STunnelblick-SConfigurations-SP92 VPN.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log

          --cd

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

          --setenv

          IV_GUI_VER

          "net.tunnelblick.tunnelblick 4921 3.7.4b (build 4921)"

          --verb

          3

          --config

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources/config.ovpn

          --verb

          3

          --cd

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

          --management

          127.0.0.1

          1337

          --management-query-passwords

          --management-hold

          --script-security

          2

          --up

          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

          --down

          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2017-12-29 23:40:29 *Tunnelblick: openvpnstart starting OpenVPN

2017-12-29 23:40:30 OpenVPN 2.3.18 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Dec  7 2017

2017-12-29 23:40:30 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10

2017-12-29 23:40:30 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337

2017-12-29 23:40:30 Need hold release from management interface, waiting...

2017-12-29 23:40:30 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337

2017-12-29 23:40:30 *Tunnelblick: Established communication with OpenVPN

2017-12-29 23:40:30 MANAGEMENT: CMD 'pid'

2017-12-29 23:40:30 MANAGEMENT: CMD 'state on'

2017-12-29 23:40:30 MANAGEMENT: CMD 'state'

2017-12-29 23:40:30 MANAGEMENT: CMD 'bytecount 1'

2017-12-29 23:40:30 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:44 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-29 23:40:44 MANAGEMENT: CMD 'password [...]'

2017-12-29 23:40:44 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:44 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:44 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:44 MANAGEMENT: >STATE:1514587244,RESOLVE,,,

2017-12-29 23:40:44 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:44 MANAGEMENT: >STATE:1514587244,TCP_CONNECT,,,

2017-12-29 23:40:45 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-29 23:40:45 TCPv4_CLIENT link local: [undef]

2017-12-29 23:40:45 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-29 23:40:45 MANAGEMENT: >STATE:1514587245,WAIT,,,

2017-12-29 23:40:45 MANAGEMENT: >STATE:1514587245,AUTH,,,

2017-12-29 23:40:45 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=b53531ec 08eb1db2

2017-12-29 23:40:45 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:45 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:45 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:45 TLS Error: TLS handshake failed

2017-12-29 23:40:45 Fatal TLS error (check_tls_errors_co), restarting

2017-12-29 23:40:45 SIGUSR1[soft,tls-error] received, process restarting

2017-12-29 23:40:45 MANAGEMENT: >STATE:1514587245,RECONNECTING,tls-error,,

2017-12-29 23:40:45 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:45 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:45 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:45 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:45 MANAGEMENT: >STATE:1514587245,RESOLVE,,,

2017-12-29 23:40:45 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:45 MANAGEMENT: >STATE:1514587245,TCP_CONNECT,,,

2017-12-29 23:40:46 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-29 23:40:46 TCPv4_CLIENT link local: [undef]

2017-12-29 23:40:46 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-29 23:40:46 MANAGEMENT: >STATE:1514587246,WAIT,,,

2017-12-29 23:40:46 MANAGEMENT: >STATE:1514587246,AUTH,,,

2017-12-29 23:40:46 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=5c66f075 bf7b6e2a

2017-12-29 23:40:46 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-29 23:40:46 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-29 23:40:46 MANAGEMENT: CMD 'password [...]'

2017-12-29 23:40:46 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:46 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:46 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:46 TLS Error: TLS handshake failed

2017-12-29 23:40:46 Fatal TLS error (check_tls_errors_co), restarting

2017-12-29 23:40:46 SIGUSR1[soft,tls-error] received, process restarting

2017-12-29 23:40:46 MANAGEMENT: >STATE:1514587246,RECONNECTING,tls-error,,

2017-12-29 23:40:46 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:46 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:46 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:46 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:46 MANAGEMENT: >STATE:1514587246,RESOLVE,,,

2017-12-29 23:40:46 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:46 MANAGEMENT: >STATE:1514587246,TCP_CONNECT,,,

2017-12-29 23:40:47 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-29 23:40:47 TCPv4_CLIENT link local: [undef]

2017-12-29 23:40:47 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-29 23:40:47 MANAGEMENT: >STATE:1514587247,WAIT,,,

2017-12-29 23:40:47 MANAGEMENT: >STATE:1514587247,AUTH,,,

2017-12-29 23:40:47 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=6beb7593 6511277a

2017-12-29 23:40:47 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-29 23:40:47 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-29 23:40:47 MANAGEMENT: CMD 'password [...]'

2017-12-29 23:40:47 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:47 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:47 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:47 TLS Error: TLS handshake failed

2017-12-29 23:40:47 Fatal TLS error (check_tls_errors_co), restarting

2017-12-29 23:40:47 SIGUSR1[soft,tls-error] received, process restarting

2017-12-29 23:40:47 MANAGEMENT: >STATE:1514587247,RECONNECTING,tls-error,,

2017-12-29 23:40:47 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:47 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:47 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:47 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:47 MANAGEMENT: >STATE:1514587247,RESOLVE,,,

2017-12-29 23:40:47 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:47 MANAGEMENT: >STATE:1514587247,TCP_CONNECT,,,

2017-12-29 23:40:48 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-29 23:40:48 TCPv4_CLIENT link local: [undef]

2017-12-29 23:40:48 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-29 23:40:48 MANAGEMENT: >STATE:1514587248,WAIT,,,

2017-12-29 23:40:48 MANAGEMENT: >STATE:1514587248,AUTH,,,

2017-12-29 23:40:48 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=a72af826 fb6f9096

2017-12-29 23:40:48 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-29 23:40:48 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-29 23:40:48 MANAGEMENT: CMD 'password [...]'

2017-12-29 23:40:49 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:49 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:49 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:49 TLS Error: TLS handshake failed

2017-12-29 23:40:49 Fatal TLS error (check_tls_errors_co), restarting

2017-12-29 23:40:49 SIGUSR1[soft,tls-error] received, process restarting

2017-12-29 23:40:49 MANAGEMENT: >STATE:1514587249,RECONNECTING,tls-error,,

2017-12-29 23:40:49 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:49 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:49 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:49 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:49 MANAGEMENT: >STATE:1514587249,RESOLVE,,,

2017-12-29 23:40:49 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:49 MANAGEMENT: >STATE:1514587249,TCP_CONNECT,,,

2017-12-29 23:40:50 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-29 23:40:50 TCPv4_CLIENT link local: [undef]

2017-12-29 23:40:50 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-29 23:40:50 MANAGEMENT: >STATE:1514587250,WAIT,,,

2017-12-29 23:40:50 MANAGEMENT: >STATE:1514587250,AUTH,,,

2017-12-29 23:40:50 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=c9af750d e20aec97

2017-12-29 23:40:50 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-29 23:40:50 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-29 23:40:50 MANAGEMENT: CMD 'password [...]'

2017-12-29 23:40:50 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:50 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:50 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:50 TLS Error: TLS handshake failed

*** I omitted quite a lot of completely similar retries ***

2017-12-29 23:40:58 Fatal TLS error (check_tls_errors_co), restarting2017-12-29 23:40:58 SIGUSR1[soft,tls-error] received, process restarting

2017-12-29 23:40:58 MANAGEMENT: >STATE:1514587258,RECONNECTING,tls-error,,

2017-12-29 23:40:58 MANAGEMENT: CMD 'hold release'

2017-12-29 23:40:58 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.

2017-12-29 23:40:58 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-29 23:40:58 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-29 23:40:58 MANAGEMENT: >STATE:1514587258,RESOLVE,,,

2017-12-29 23:40:58 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-29 23:40:58 MANAGEMENT: >STATE:1514587258,TCP_CONNECT,,,

2017-12-29 23:40:59 SIGTERM[hard,init_instance] received, process exiting

2017-12-29 23:40:59 MANAGEMENT: >STATE:1514587259,EXITING,init_instance,,

2017-12-29 23:40:59 *Tunnelblick: No 'post-disconnect.sh' script to execute

2017-12-29 23:40:59 *Tunnelblick: Expected disconnection occurred.

================================================================================

"Sanitized" full configuration file

##############################################

# Sample client-side OpenVPN 2.0 config file #

# for connecting to multi-client server.     #

#                                            #

# This configuration can be used by multiple #

# clients, however each client should have   #

# its own cert and key files.                #

#                                            #

# On Windows, you might want to rename this  #

# file so it has a .ovpn extension           #

##############################################

# Specify that we are a client and that we

# will be pulling certain config file directives

# from the server.

client

# Use the same setting as you are using on

# the server.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel

# if you have more than one.  On XP SP2,

# you may need to disable the firewall

# for the TAP adapter.

;dev-node MyTap

# Are we connecting to a TCP or

# UDP server?  Use the same setting as

# on the server.

proto tcp

;proto udp

# The hostname/IP and port of the server.

# You can have multiple remote entries

# to load balance between the servers.

remote vpn.p92.hu 1194

;remote my-server-2 1194

# Choose a random host from the remote

# list for load-balancing.  Otherwise

# try hosts in the order specified.

;remote-random

# Keep trying indefinitely to resolve the

# host name of the OpenVPN server.  Very useful

# on machines which are not permanently connected

# to the internet such as laptops.

resolv-retry infinite

# Most clients don't need to bind to

# a specific local port number.

nobind

# Downgrade privileges after initialization (non-Windows only)

;user

;group

# Try to preserve some state across restarts.

persist-key

persist-tun

# If you are connecting through an

# HTTP proxy to reach the actual OpenVPN

# server, put the proxy server/IP and

# port number here.  See the man page

# if your proxy server requires

# authentication.

;http-proxy-retry # retry on connection failures

;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot

# of duplicate packets.  Set this flag

# to silence duplicate packet warnings.

;mute-replay-warnings

# SSL/TLS parms.

# See the server config file for more

# description.  It's best to use

# a separate .crt/.key file pair

# for each client.  A single ca

# file can be used for all clients.

#ca /usr/share/easy-rsa/keys/ca.crt

#cert /usr/share/easy-rsa/keys/client1.crt

#key /usr/share/easy-rsa/keys/client1.key

# Verify server certificate by checking

# that the certicate has the nsCertType

# field set to "server".  This is an

# important precaution to protect against

# a potential attack discussed here:

#  http://openvpn.net/howto.html#mitm

#

# To use this feature, you will need to generate

# your server certificates with the nsCertType

# field set to "server".  The build-key-server

# script in the easy-rsa folder will do this.

ns-cert-type server

# If a tls-auth key is used on the server

# then every client must also have the key.

;tls-auth ta.key 1

# Select a cryptographic cipher.

# If the cipher option is used on the server

# then you must also specify it here.

;cipher x

# Enable compression on the VPN link.

# Don't enable this unless it is also

# enabled in the server config file.

;comp-lzo

# Set log file verbosity.

verb 3

# Silence repeating messages

;mute 20

;route-up "route add LAN-IP mask 255.255.255.0 172.21.0.1"

auth-nocache

tls-client

auth-user-pass

route 10.128.0.0 255.255.0.0

dhcp-option DNS 10.128.32.201

daemon

keepalive 10 120

<ca>

 [Security-related line(s) omitted]

</ca>

<cert>

 [Security-related line(s) omitted]

</cert>

<key>

 [Security-related line(s) omitted]

</key>

================================================================================

ifconfig output:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384

options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>

inet 127.0.0.1 netmask 0xff000000 

inet6 ::1 prefixlen 128 

inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 

nd6 options=201<PERFORMNUD,DAD>

gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280

stf0: flags=0<> mtu 1280

en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500

options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>

ether 00:23:df:de:39:14 

inet6 fe80::1076:8fba:9d0a:992a%en0 prefixlen 64 secured scopeid 0x4 

inet 172.16.0.24 netmask 0xffffff00 broadcast 172.16.0.255

nd6 options=201<PERFORMNUD,DAD>

media: autoselect (1000baseT <full-duplex,flow-control>)

status: active

en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500

options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>

ether 00:23:df:de:54:e9 

nd6 options=201<PERFORMNUD,DAD>

media: autoselect (<unknown type>)

status: inactive

en2: flags=8823<UP,BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500

ether 00:26:08:fe:02:13 

nd6 options=201<PERFORMNUD,DAD>

media: autoselect (<unknown type>)

status: inactive

fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 2030

lladdr 00:23:df:ff:fe:da:b6:88 

nd6 options=201<PERFORMNUD,DAD>

media: autoselect <full-duplex>

status: inactive

p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304

ether 02:26:08:fe:02:13 

media: autoselect

status: inactive

utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000

inet6 fe80::683a:bebf:764e:b687%utun0 prefixlen 64 scopeid 0x9 

nd6 options=201<PERFORMNUD,DAD>

================================================================================

Console Log:

2017-12-29 23:29:52 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:53 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:53 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:54 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:54 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:55 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:55 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:56 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:56 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:57 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:57 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:29:59 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:29:59 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:00 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:00 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:01 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:01 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:02 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:02 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:03 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:03 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:04 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:04 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:05 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:05 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:07 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:07 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:08 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:08 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:09 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:09 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:10 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:10 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:11 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:11 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:12 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:12 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:13 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:13 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:15 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:15 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:16 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:16 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:17 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:17 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:18 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:18 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:19 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:19 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:20 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:20 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:22 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:22 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:23 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:23 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:24 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:24 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:25 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:25 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:26 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:26 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:27 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:27 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:29 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:29 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:30 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:30 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:31 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:31 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:32 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:32 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:33 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:33 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:34 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:34 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:35 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:35 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:37 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:37 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:38 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:38 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:39 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:39 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:40 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:40 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:41 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:41 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:42 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:42 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:44 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:44 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:45 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:45 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:46 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:46 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:47 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:47 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:48 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:48 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:49 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:49 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:30:51 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:30:51 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:10 tunnelblickd[2514] Status = 252 from tunnelblick-helper command 'compareShadowCopy P92 VPN'

2017-12-29 23:31:10 Tunnelblick[2444] tunnelblickd status from compareShadowCopy: 252

2017-12-29 23:31:14 Tunnelblick[2444] Tunnelblick needs to perform an action that requires administrator authorization.

2017-12-29 23:31:14 Tunnelblick[2444] Beginning installation or repair

2017-12-29 23:31:14 Tunnelblick[2444] Installation or repair succeeded; Log:

                                       Tunnelblick installer started 2017-12-29 23:31:14. 3 arguments: 0x0001

                                            /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                            /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

                                       Copied /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

                                           to /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk.temp

                                       Renamed /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk.temp

                                            to /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk and its contents from 501:80 to 0:0

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources/config.ovpn

                                       Tunnelblick installer finished without error

2017-12-29 23:31:14 Tunnelblick[2444] Created or updated secure (shadow) copy of configuration file /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

2017-12-29 23:31:15 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:15 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:17 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:17 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:18 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:18 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:20 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:20 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:21 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:21 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:22 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:22 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:23 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:23 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:24 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:24 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:25 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:25 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:27 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:27 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:28 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:28 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:29 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:29 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:30 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:30 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:31 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:31 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:32 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:32 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:33 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:33 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:35 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:35 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:36 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:36 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:37 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:37 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:43 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:43 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:45 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:31:45 Tunnelblick[2444] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:31:48 Tunnelblick[2444] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes

2017-12-29 23:31:48 Tunnelblick[2444] Finished shutting down Tunnelblick; allowing termination

2017-12-29 23:31:53 Tunnelblick[2555] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4b (build 4921)

2017-12-29 23:31:55 Tunnelblick[2555] Sparkle: ===== Tunnelblick =====

2017-12-29 23:31:55 Tunnelblick[2555] Sparkle: Verified appcast signature

2017-12-29 23:33:22 tunnelblickd[2580] Status = 252 from tunnelblick-helper command 'compareShadowCopy P92 VPN'

2017-12-29 23:33:22 Tunnelblick[2555] tunnelblickd status from compareShadowCopy: 252

2017-12-29 23:33:26 Tunnelblick[2555] Tunnelblick needs to perform an action that requires administrator authorization.

2017-12-29 23:33:26 Tunnelblick[2555] Beginning installation or repair

2017-12-29 23:33:26 Tunnelblick[2555] Installation or repair succeeded; Log:

                                       Tunnelblick installer started 2017-12-29 23:33:26. 3 arguments: 0x0001

                                            /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                            /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

                                       Copied /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

                                           to /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk.temp

                                       Renamed /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk.temp

                                            to /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk and its contents from 501:80 to 0:0

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents

                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources/config.ovpn

                                       Tunnelblick installer finished without error

2017-12-29 23:33:26 Tunnelblick[2555] Created or updated secure (shadow) copy of configuration file /Users/gabriel/Library/Application Support/Tunnelblick/Configurations/P92 VPN.tblk

2017-12-29 23:33:27 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:33:27 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:33:29 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:33:29 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:33:30 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:33:30 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:33:32 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:33:32 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:35:15 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:35:15 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:35:17 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:35:17 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:35:18 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:35:18 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:44 Tunnelblick[2555] Can't find Keychain item to delete for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username' because it does not exist

2017-12-29 23:40:44 Tunnelblick[2555] Can't find Keychain item to delete for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password' because it does not exist

2017-12-29 23:40:46 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:46 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:47 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:47 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:48 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:48 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:50 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:50 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:51 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:51 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:52 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:52 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:53 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:53 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:54 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:54 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:55 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:55 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:57 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:57 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-29 23:40:58 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-29 23:40:58 Tunnelblick[2555] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

[Tunnelblick developer]

Hi. The last person with the problem (mgmmodel) never provided any information about how he solved the problem.

Here are a couple of things you can try:

• Use a different copy of OpenVPN: one that uses LibreSSL instead of OpenSSL. (Change it on the "Settings" tab of the "Configurations" panel of Tunnelblick's "OpenVPN Details" window. Select the configuration(s) in the list on the left side of the window before making the change.
  
  Even if it fails, the error message from LibreSSL might be more helpful than OpenSSL's cryptic and uninformative messages.
  
  
• Use Tunnelblick 3.7.1b (download it from our Deprecated Downloads page). It includes a slightly older version of OpenSSL (1.0.2k, vs. 1.0.2n in the current version of Tunnelblick).

If they don't work (or if you are unhappy -- as I would be -- using an old version which may contain serious security vulnerabilities that will never be fixed), your best bet is to get help from OpenVPN experts:

• OpenVPN FAQ
• OpenVPN HOWTO
• OpenVPN 2.3 Man Page
• OpenVPN Documentation
• OpenVPN Users Forum
• OpenVPN Users Mailing List

Focus on the following, which shows the original error:

2017-12-29 23:40:45 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=b53531ec 08eb1db2

2017-12-29 23:40:45 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-29 23:40:45 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-29 23:40:45 TLS Error: TLS object -> incoming plaintext read error

2017-12-29 23:40:45 TLS Error: TLS handshake failed

2017-12-29 23:40:45 Fatal TLS error (check_tls_errors_co), restarting

It could be an incompatibility between the version of OpenVPN in Tunnelblick (1.0.2n) and the version used by OpenVPN on the server, or on other restrictions imposed by the server, or it could be a problem with the certificates or keys (such as keys that were once OK but are now considered too short to be secure).

I notice that "sslv3" appears in the first error message, and SSLv3 is a very, very old and broken protocol for SSL negotiation (it was obsoleted by TLS 1.0 eighteen years ago, and finally prohibited in 2015!) Of course, it may just be the name used for all SSL negotiations, but it looks odd to me.

Please, please report back what you try and what finally fixes the problem (I hope!)

[gabriel....@gmail.com]

Hi,

I tried with the current version, switching to LibreSSL as well as downloaded the 3.7.1b version and tried both the default library and LibreSSL as well.

They all yield the same result.

Here's my diagnostic info with LibreSSL (looks pretty much the same to me :( )

*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.1b (build 4813); prior version 3.7.4b (build 4921); Admin user

git commit ea4b9e30939b4dfd3b69a71f62e91625fa8dd97f

-openvpnVersion = 2.3.17-libressl-2.5.0

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

-doNotDisableIpv6onTun = 1

-loggingLevel = 3

-lastConnectionSucceeded = 0

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

================================================================================

Program preferences:

launchAtNextLogin = 1

notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

tunnelblickVersionHistory = (

    "3.7.1b (build 4813)",

    "3.7.4b (build 4921)",

    "3.7.4a (build 4920)"

)

statusDisplayNumber = 0

lastLaunchTime = 536290292.951443

lastLanguageAtLaunchWasRTL = 0

connectionWindowDisplayCriteria = showWhenConnecting

maxLogDisplaySize = 102400

keyboardShortcutIndex = 1

namedCredentialsThatAllConfigurationsUse = androczkyg

namedCredentialsNames = (

    androczkyg

)

updateCheckAutomatically = 0

updateSendProfileInfo = 0

NSWindow Frame SettingsSheetWindow = 546 241 829 524 0 0 1920 1177 

NSWindow Frame ConnectingWindow = 765 754 389 187 0 0 1920 1177 

NSWindow Frame SUUpdateAlert = 650 600 620 392 0 0 1920 1177 

detailsWindowFrameVersion = 4921

detailsWindowFrame = {{960, 480}, {920, 468}}

detailsWindowLeftFrame = {{0, 0}, {165, 350}}

detailsWindowViewIndex = 0

detailsWindowConfigurationsTabIdentifier = settings

leftNavSelectedDisplayName = P92 VPN

AdvancedWindowTabIdentifier = sounds

haveDealtWithSparkle1dot5b6 = 1

haveDealtWithOldTunTapPreferences = 1

haveDealtWithOldLoginItem = 1

SUEnableAutomaticChecks = 0

SUScheduledCheckInterval = 86400

SUSendProfileInfo = 0

SULastCheckTime = 2017-12-30 01:31:36 +0000

SUHasLaunchedBefore = 1

WebKitDefaultFontSize = 16

WebKitStandardFont = Times

================================================================================

Tunnelblick Log:

*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.1b (build 4813); prior version 3.7.4b (build 4921)

2017-12-30 02:34:25 *Tunnelblick: Attempting connection with P92 VPN using shadow copy; Set nameserver = 769; monitoring connection

2017-12-30 02:34:25 *Tunnelblick: openvpnstart start P92\ VPN.tblk 1338 769 0 1 0 16688 -ptADGNWradsgnw 2.3.17-libressl-2.5.0

2017-12-30 02:34:25 OpenVPN 2.3.17 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jun 21 2017

2017-12-30 02:34:25 library versions: LibreSSL 2.5.0, LZO 2.09

2017-12-30 02:34:25 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1338

2017-12-30 02:34:25 Need hold release from management interface, waiting...

2017-12-30 02:34:25 *Tunnelblick: openvpnstart starting OpenVPN

2017-12-30 02:34:26 *Tunnelblick: openvpnstart log:

     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

     

          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.17-libressl-2.5.0/openvpn

          --daemon

          --log

          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sgabriel-SLibrary-SApplication Support-STunnelblick-SConfigurations-SP92 VPN.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_16688.1338.openvpn.log

          --cd

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

          --verb

          3

          --config

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources/config.ovpn

          --verb

          3

          --cd

          /Library/Application Support/Tunnelblick/Users/gabriel/P92 VPN.tblk/Contents/Resources

          --management

          127.0.0.1

          1338

          --management-query-passwords

          --management-hold

          --script-security

          2

          --up

          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw

          --down

          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw

2017-12-30 02:34:26 *Tunnelblick: Established communication with OpenVPN

2017-12-30 02:34:26 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-30 02:34:26 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1338

2017-12-30 02:34:26 MANAGEMENT: CMD 'pid'

2017-12-30 02:34:26 MANAGEMENT: CMD 'state on'

2017-12-30 02:34:26 MANAGEMENT: CMD 'state'

2017-12-30 02:34:26 MANAGEMENT: CMD 'bytecount 1'

2017-12-30 02:34:26 MANAGEMENT: CMD 'hold release'

2017-12-30 02:34:26 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-30 02:34:26 MANAGEMENT: CMD 'password [...]'

2017-12-30 02:34:26 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-30 02:34:26 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-30 02:34:26 MANAGEMENT: >STATE:1514597666,RESOLVE,,,

2017-12-30 02:34:26 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-30 02:34:26 MANAGEMENT: >STATE:1514597666,TCP_CONNECT,,,

2017-12-30 02:34:27 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-30 02:34:27 TCPv4_CLIENT link local: [undef]

2017-12-30 02:34:27 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-30 02:34:27 MANAGEMENT: >STATE:1514597667,WAIT,,,

2017-12-30 02:34:27 MANAGEMENT: >STATE:1514597667,AUTH,,,

2017-12-30 02:34:27 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=77c2cf29 e0e6147a

2017-12-30 02:34:27 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-30 02:34:27 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-30 02:34:27 TLS Error: TLS object -> incoming plaintext read error

2017-12-30 02:34:27 TLS Error: TLS handshake failed

2017-12-30 02:34:27 Fatal TLS error (check_tls_errors_co), restarting

2017-12-30 02:34:27 SIGUSR1[soft,tls-error] received, process restarting

2017-12-30 02:34:27 MANAGEMENT: >STATE:1514597667,RECONNECTING,tls-error,,

2017-12-30 02:34:27 MANAGEMENT: CMD 'hold release'

2017-12-30 02:34:27 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-30 02:34:27 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-30 02:34:27 MANAGEMENT: >STATE:1514597667,RESOLVE,,,

2017-12-30 02:34:27 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-30 02:34:27 MANAGEMENT: >STATE:1514597667,TCP_CONNECT,,,

2017-12-30 02:34:28 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-30 02:34:28 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-30 02:34:28 TCPv4_CLIENT link local: [undef]

2017-12-30 02:34:28 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-30 02:34:28 MANAGEMENT: >STATE:1514597668,WAIT,,,

2017-12-30 02:34:28 MANAGEMENT: >STATE:1514597668,AUTH,,,

2017-12-30 02:34:28 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=48eccb30 7536be4e

2017-12-30 02:34:28 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-30 02:34:28 MANAGEMENT: CMD 'password [...]'

2017-12-30 02:34:28 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-30 02:34:28 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-30 02:34:28 TLS Error: TLS object -> incoming plaintext read error

2017-12-30 02:34:28 TLS Error: TLS handshake failed

2017-12-30 02:34:28 Fatal TLS error (check_tls_errors_co), restarting

2017-12-30 02:34:28 SIGUSR1[soft,tls-error] received, process restarting

2017-12-30 02:34:28 MANAGEMENT: >STATE:1514597668,RECONNECTING,tls-error,,

2017-12-30 02:34:28 MANAGEMENT: CMD 'hold release'

2017-12-30 02:34:28 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-30 02:34:28 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-30 02:34:28 MANAGEMENT: >STATE:1514597668,RESOLVE,,,

2017-12-30 02:34:28 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-30 02:34:28 MANAGEMENT: >STATE:1514597668,TCP_CONNECT,,,

2017-12-30 02:34:29 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-30 02:34:29 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-30 02:34:29 TCPv4_CLIENT link local: [undef]

2017-12-30 02:34:29 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-30 02:34:29 MANAGEMENT: >STATE:1514597669,WAIT,,,

2017-12-30 02:34:29 MANAGEMENT: >STATE:1514597669,AUTH,,,

2017-12-30 02:34:29 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=73bac99c bda5ff44

2017-12-30 02:34:29 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-30 02:34:29 MANAGEMENT: CMD 'password [...]'

2017-12-30 02:34:29 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-30 02:34:29 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-30 02:34:29 TLS Error: TLS object -> incoming plaintext read error

2017-12-30 02:34:29 TLS Error: TLS handshake failed

2017-12-30 02:34:29 Fatal TLS error (check_tls_errors_co), restarting

2017-12-30 02:34:29 SIGUSR1[soft,tls-error] received, process restarting

2017-12-30 02:34:29 MANAGEMENT: >STATE:1514597669,RECONNECTING,tls-error,,

2017-12-30 02:34:29 MANAGEMENT: CMD 'hold release'

2017-12-30 02:34:29 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-30 02:34:29 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-30 02:34:29 MANAGEMENT: >STATE:1514597669,RESOLVE,,,

2017-12-30 02:34:29 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-30 02:34:29 MANAGEMENT: >STATE:1514597669,TCP_CONNECT,,,

2017-12-30 02:34:30 *Tunnelblick: Obtained VPN username and password from the Keychain

2017-12-30 02:34:30 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-30 02:34:30 TCPv4_CLIENT link local: [undef]

2017-12-30 02:34:30 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-30 02:34:30 MANAGEMENT: >STATE:1514597670,WAIT,,,

2017-12-30 02:34:30 MANAGEMENT: >STATE:1514597670,AUTH,,,

2017-12-30 02:34:30 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=983e1bdf 124e369b

2017-12-30 02:34:30 MANAGEMENT: CMD 'username "Auth" "androczkyg"'

2017-12-30 02:34:30 MANAGEMENT: CMD 'password [...]'

2017-12-30 02:34:30 OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

2017-12-30 02:34:30 TLS_ERROR: BIO read tls_read_plaintext error

2017-12-30 02:34:30 TLS Error: TLS object -> incoming plaintext read error

2017-12-30 02:34:30 TLS Error: TLS handshake failed

2017-12-30 02:34:30 Fatal TLS error (check_tls_errors_co), restarting

2017-12-30 02:34:30 SIGUSR1[soft,tls-error] received, process restarting

2017-12-30 02:34:30 MANAGEMENT: >STATE:1514597670,RECONNECTING,tls-error,,

2017-12-30 02:34:30 MANAGEMENT: CMD 'hold release'

2017-12-30 02:34:30 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-12-30 02:34:30 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-12-30 02:34:30 MANAGEMENT: >STATE:1514597670,RESOLVE,,,

2017-12-30 02:34:30 Attempting to establish TCP connection with [AF_INET]193.68.38.6:1194 [nonblock]

2017-12-30 02:34:30 MANAGEMENT: >STATE:1514597670,TCP_CONNECT,,,

2017-12-30 02:34:31 *Tunnelblick: Disconnecting; notification window disconnect button pressed

2017-12-30 02:34:31 *Tunnelblick: No 'pre-disconnect.sh' script to execute

2017-12-30 02:34:31 *Tunnelblick: Disconnecting using 'kill'

2017-12-30 02:34:31 TCP connection established with [AF_INET]193.68.38.6:1194

2017-12-30 02:34:31 TCPv4_CLIENT link local: [undef]

2017-12-30 02:34:31 TCPv4_CLIENT link remote: [AF_INET]193.68.38.6:1194

2017-12-30 02:34:31 MANAGEMENT: >STATE:1514597671,WAIT,,,

2017-12-30 02:34:31 MANAGEMENT: >STATE:1514597671,AUTH,,,

2017-12-30 02:34:31 TLS: Initial packet from [AF_INET]193.68.38.6:1194, sid=c81e1033 404cc5b3

2017-12-30 02:34:31 event_wait : Interrupted system call (code=4)

2017-12-30 02:34:31 SIGTERM[hard,] received, process exiting

2017-12-30 02:34:31 MANAGEMENT: >STATE:1514597671,EXITING,SIGTERM,,

2017-12-30 02:34:32 *Tunnelblick: No 'post-disconnect.sh' script to execute

2017-12-30 02:34:32 *Tunnelblick: Expected disconnection occurred.

2017-12-30 02:31:10 Tunnelblick[3048] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.1b (build 4813)

2017-12-30 02:31:11 Tunnelblick[3048] Tunnelblick cannot run when it is on /Volumes because the volume has the MNT_NOSUID statfs flag set.

2017-12-30 02:31:15 Tunnelblick[3048] Tunnelblick needs to:

                                         • Be installed in /Applications as Tunnelblick

                                         • Change ownership and permissions of the program to secure it

                                         • Secure configurations

2017-12-30 02:31:15 Tunnelblick[3048] Beginning installation or repair

2017-12-30 02:31:16 Tunnelblick[3048] Installation or repair succeeded; Log:

                                       Tunnelblick installer started 2017-12-30 02:31:15. 1 arguments: 0x0017

                                       Moved /Applications/Tunnelblick.app to the Trash

                                       Copied /Volumes/Tunnelblick/Tunnelblick.app to /Applications/Tunnelblick.app

                                       Removed all 'com.apple.quarantine' extended attributes

                                       Changed ownership of /Applications/Tunnelblick.app and its contents from 501:80 to 0:0

                                       Need to replace and/or reload 'tunnelblickd':

                                           daemonHashesMatch  = NO

                                           plistHashesMatch   = YES

                                           activePlistMatches = YES

                                       Replaced /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist

                                       Used launchctl to load tunnelblickd

                                       Tunnelblick installer finished without error

2017-12-30 02:31:16 Tunnelblick[3048] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes

2017-12-30 02:31:16 Tunnelblick[3059] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.1b (build 4813)

2017-12-30 02:31:16 Tunnelblick[3048] Finished shutting down Tunnelblick; allowing termination

2017-12-30 02:31:23 Tunnelblick[3059] Sparkle: ===== Tunnelblick =====

2017-12-30 02:31:23 Tunnelblick[3059] Sparkle: Verified appcast signature

2017-12-30 02:31:48 Tunnelblick[3059] OpenVPN version 2.3.18-libressl-2.6.2 is not available; using version 2.4.3-libressl-2.5.0

2017-12-30 02:31:49 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:49 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:31:55 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:55 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:31:56 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:56 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:31:57 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:57 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:31:58 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:58 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:31:59 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:31:59 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:00 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:00 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:33 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:33 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:38 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:38 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:39 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:39 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:40 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:40 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:41 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:41 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:42 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:42 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:44 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:44 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:32:45 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:32:45 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:00 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:00 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:05 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:05 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:07 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:07 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:08 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:08 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:09 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:09 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:11 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:11 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:12 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:12 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:33:59 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:33:59 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:34:01 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:34:01 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:34:26 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:34:26 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:34:28 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:34:28 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:34:29 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:34:29 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

2017-12-30 02:34:30 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'username'

2017-12-30 02:34:30 Tunnelblick[3059] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-Group-androczkyg' account = 'password'

[Tunnelblick developer]

Yeah, the same error messages. LibreSSL is a fork of OpenSSL so I guess they haven't touched those error messages yet.