format error in certificate's notAfter field

244 views
Skip to first unread message

Raúl Uría

unread,
Dec 29, 2020, 6:40:39 AM12/29/20
to tunnelblick-discuss
Hi, I'm trying to connect to α customer VPN, and getting "VERIFY ERROR: depth=0, error=format error in certificate's notAfter field: C=es, L=XX, O=YYYYYYYY, CN=ZZZZZ, emailAddress=WWWWWW, serial=17702460327850242852" (XX, YYY,... are placeholder)

Initially, I thought openssl was the problem, but I can't figure out what certificate is the problem with. The certs that I get cert from server ( with openssl s_client -connect x.y.z.w:443 -showcerts) are not the cert indicate in the error, the serial number is different, I am confuse about that. What is the cert which raise the error? How can I get it?

My conf is:

client
dev tun
proto tcp
remote X.Y.Z.W 443
verify-x509-name "C=es, L=XX, O=YYYYYYYY, CN=ZZZZZ, emailAddress=WWWWWW"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
...

Tunnelblick developer

unread,
Dec 29, 2020, 6:46:10 AM12/29/20
to tunnelblick-discuss
Please post the diagnostic info obtained by following the instructions at Read Before You Post. in your situation, it won't ever connect, so you don't need to do the waiting in steps 10 and 11 or press the Disconnect button; just wait until it fails and then get the diagnostic info.

Raúl Uría

unread,
Dec 29, 2020, 10:04:53 AM12/29/20
to tunnelblick-discuss
Thanks for take time to look into this. Diagnostic info is:

*Tunnelblick: macOS 11.1 (20C69); Tunnelblick 3.8.5beta02 (build 5620); prior version 3.8.4a (build 5601); Admin user
git commit e6ce2cbb9353b6f6e97bbf1ba90f4957a065121b
The Tunnelblick.app process is not being translated
System Integrity Protection is enabled

Configuration XO

"Sanitized" condensed configuration file for /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk:

client
dev tun
proto tcp
remote XX.YY.ZZ.WW 443
verify-x509-name "C=es, L=XX, O=YY, CN=ZZ, emailAddress=WW"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass
tls-cipher "DEFAULT:@SECLEVEL=0"
cipher AES-128-CBC
auth MD5
comp-lzo
route-delay 4
verb 3
reneg-sec 0
<ca>
[Security-related line(s) omitted]
</ca>
<cert>
[Security-related line(s) omitted]
</cert>
<key>
[Security-related line(s) omitted]
</key>


================================================================================

Files in XO.tblk:
      Contents/Resources/config.ovpn

================================================================================

Tunnelblick Kext Policy Data:


================================================================================

Configuration preferences:

-keychainHasUsernameAndPassword = 1
-openvpnVersion = 
-loggingLevel = 3
-alwaysShowLoginWindow = 0
-lastConnectionSucceeded = 0

================================================================================

Wildcard preferences:


================================================================================

Program preferences:

launchAtNextLogin = 1
tunnelblickVersionHistory = (
    "3.8.5beta02 (build 5620)",
    "3.8.4a (build 5601)",
    "3.8.4 (build 5600)"
)
lastLaunchTime = 630946377.950474
lastLanguageAtLaunchWasRTL = 0
connectionWindowDisplayCriteria = showWhenConnecting
maxLogDisplaySize = 102400
lastConnectedDisplayName = ZZircon
keyboardShortcutIndex = 1
updateCheckAutomatically = 1
updateCheckBetas = 1
NSWindow Frame ConnectingWindow = 701 696 389 193 0 0 1792 1095 
NSWindow Frame SUUpdateAlert = 586 543 620 398 0 0 1792 1095 
detailsWindowFrameVersion = 5620
detailsWindowFrame = {{251, 481}, {1077, 542}}
detailsWindowLeftFrame = {{0, 0}, {197, 422}}
detailsWindowViewIndex = 0
detailsWindowConfigurationsTabIdentifier = log
leftNavSelectedDisplayName = XO
AdvancedWindowTabIdentifier = connectingAndDisconnecting
haveDealtWithOldTunTapPreferences = 1
haveDealtWithOldLoginItem = 1
haveDealtWithAfterDisconnect = 1
SUEnableAutomaticChecks = 1
SUScheduledCheckInterval = 86400
SULastCheckTime = 2020-12-29 14:52:58 +0000
SUHasLaunchedBefore = 1
WebKitDefaultFontSize = 16
WebKitStandardFont = Times

================================================================================

Forced preferences:

(None)

================================================================================

Deployed forced preferences:

(None)

================================================================================

Tunnelblick Log:

2020-12-29 15:53:20.125907 *Tunnelblick: macOS 11.1 (20C69); Tunnelblick 3.8.5beta02 (build 5620); prior version 3.8.4a (build 5601)
2020-12-29 15:53:20.639365 *Tunnelblick: Attempting connection with XO using shadow copy; Set nameserver = 769; monitoring connection
2020-12-29 15:53:20.639962 *Tunnelblick: openvpnstart start XO.tblk 60941 769 0 1 0 1098032 -ptADGNWradsgnw 2.4.10-openssl-1.1.1i
2020-12-29 15:53:20.659713 *Tunnelblick: openvpnstart starting OpenVPN
2020-12-29 15:53:21.011487 OpenVPN 2.4.10 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec 14 2020
2020-12-29 15:53:21.011553 library versions: OpenSSL 1.1.1i  8 Dec 2020, LZO 2.10
2020-12-29 15:53:21.013239 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:60941
2020-12-29 15:53:21.013267 Need hold release from management interface, waiting...
2020-12-29 15:53:21.266126 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.10-openssl-1.1.1i/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SUsers-SZZPORS-SLibrary-SApplication Support-STunnelblick-SConfigurations-SXO.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1098032.60941.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5620 3.8.5beta02 (build 5620)"
          --verb 3
          --config /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources
          --verb 3
          --cd /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources
          --management 127.0.0.1 60941 /Library/Application Support/Tunnelblick/ipbflbljbdfmflgjpkafeaelfaidkeinmcpnapbl.mip
          --management-query-passwords
          --management-hold
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2020-12-29 15:53:21.275627 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:60941
2020-12-29 15:53:21.315248 MANAGEMENT: CMD 'pid'
2020-12-29 15:53:21.315307 MANAGEMENT: CMD 'auth-retry interact'
2020-12-29 15:53:21.315346 MANAGEMENT: CMD 'state on'
2020-12-29 15:53:21.315372 MANAGEMENT: CMD 'state'
2020-12-29 15:53:21.315426 MANAGEMENT: CMD 'bytecount 1'
2020-12-29 15:53:21.315950 *Tunnelblick: Established communication with OpenVPN
2020-12-29 15:53:21.317233 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2020-12-29 15:53:21.319090 MANAGEMENT: CMD 'hold release'
2020-12-29 15:53:21.361764 *Tunnelblick: Obtained VPN username and password from the Keychain
2020-12-29 15:53:21.363114 MANAGEMENT: CMD 'username "Auth" "XXXXXXXXXX"'
2020-12-29 15:53:21.363168 MANAGEMENT: CMD 'password [...]'
2020-12-29 15:53:21.363417 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-12-29 15:53:21.367028 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.YY.ZZZ.WW:443
2020-12-29 15:53:21.367086 Socket Buffers: R=[131072->131072] S=[131072->131072]
2020-12-29 15:53:21.367114 Attempting to establish TCP connection with [AF_INET]XX.YY.ZZZ.WW:443 [nonblock]
2020-12-29 15:53:21.367124 MANAGEMENT: >STATE:1609253601,TCP_CONNECT,,,,,,
2020-12-29 15:53:22.437491 TCP connection established with [AF_INET]XX.YY.ZZZ.WW:443
2020-12-29 15:53:22.437587 TCP_CLIENT link local: (not bound)
2020-12-29 15:53:22.437623 TCP_CLIENT link remote: [AF_INET]XX.YY.ZZZ.WW:443
2020-12-29 15:53:22.437758 MANAGEMENT: >STATE:1609253602,WAIT,,,,,,
2020-12-29 15:53:22.464957 MANAGEMENT: >STATE:1609253602,AUTH,,,,,,
2020-12-29 15:53:22.465031 TLS: Initial packet from [AF_INET]XX.YY.ZZZ.WW:443, sid=907c3ea0 97bfc1e5
2020-12-29 15:53:22.567703 VERIFY OK: depth=1, C=es, L=XX, O=YY, CN=ZZ, emailAddress=WWW
2020-12-29 15:53:22.568185 VERIFY ERROR: depth=0, error=format error in certificate's notAfter field: C=es, L=XX2, O=YY2, CN=ZZ2, emailAddress=WW2, serial=17702460327850242852
2020-12-29 15:53:22.568349 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2020-12-29 15:53:22.568720 TLS_ERROR: BIO read tls_read_plaintext error
2020-12-29 15:53:22.568751 TLS Error: TLS object -> incoming plaintext read error
2020-12-29 15:53:22.568767 TLS Error: TLS handshake failed
2020-12-29 15:53:22.568912 Fatal TLS error (check_tls_errors_co), restarting
2020-12-29 15:53:22.569054 SIGUSR1[soft,tls-error] received, process restarting
2020-12-29 15:53:22.569081 MANAGEMENT: >STATE:1609253602,RECONNECTING,tls-error,,,,,
2020-12-29 15:53:22.590657 MANAGEMENT: CMD 'hold release'


================================================================================

Down log:

09:01:28 *Tunnelblick:  **********************************************
09:01:28 *Tunnelblick:  Start of output from client.down.tunnelblick.sh
09:01:28 *Tunnelblick:  Cancelled monitoring system configuration changes
09:01:28 *Tunnelblick:  Restored State:DNS
09:01:28 *Tunnelblick:  Restored Setup:DNS
09:01:28 *Tunnelblick:  Removed State:SMB
09:01:28 *Tunnelblick:  Restored DNS and SMB settings
09:01:28 *Tunnelblick:  Re-enabled IPv6 (automatic) for "XO"
09:01:28 *Tunnelblick:  Flushed the DNS cache with dscacheutil -flushcache
09:01:28 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
09:01:28 *Tunnelblick:  End of output from client.down.tunnelblick.sh
09:01:28 *Tunnelblick:  **********************************************

================================================================================

Previous down log:

19:07:36 *Tunnelblick:  **********************************************
19:07:36 *Tunnelblick:  Start of output from client.down.tunnelblick.sh
19:07:36 *Tunnelblick:  Restored State:DNS
19:07:36 *Tunnelblick:  Restored Setup:DNS
19:07:36 *Tunnelblick:  Removed State:SMB
19:07:36 *Tunnelblick:  Restored DNS and SMB settings
19:07:36 *Tunnelblick:  Re-enabled IPv6 (automatic) for "XO"
19:07:36 *Tunnelblick:  End of output from client.down.tunnelblick.sh
19:07:36 *Tunnelblick:  **********************************************

================================================================================

Network services:

An asterisk (*) denotes that a network service is disabled.
LPSS Serial Adapter (1)
LPSS Serial Adapter (2)
USB 10/100/1000 LAN
Wi-Fi
Bluetooth PAN 2
Thunderbolt Bridge
BBB1
XO

Wi-Fi Power (en0): On

================================================================================

ifconfig output:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
inet 127.0.0.1 netmask 0xff000000 
inet6 ::1 prefixlen 128 
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en7: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether ac:de:48:00:11:22 
inet6 fe80::aede:48ff:fe00:1122%en7 prefixlen 64 scopeid 0x4 
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (100baseTX <full-duplex>)
status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
ether 82:86:03:e1:3c:00 
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: en2 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 12 priority 0 path cost 0
member: en4 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 10 priority 0 path cost 0
member: en1 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 11 priority 0 path cost 0
member: en3 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 9 priority 0 path cost 0
media: <unknown type>
status: inactive
ap1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether 36:7d:da:74:13:36 
media: autoselect
status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether 14:7d:da:74:13:36 
inet 192.168.3.188 netmask 0xffffff00 broadcast 192.168.3.255
media: autoselect
status: active
en3: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=460<TSO4,TSO6,CHANNEL_IO>
ether 82:86:03:e1:3c:05 
media: autoselect <full-duplex>
status: inactive
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=460<TSO4,TSO6,CHANNEL_IO>
ether 82:86:03:e1:3c:04 
media: autoselect <full-duplex>
status: inactive
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=460<TSO4,TSO6,CHANNEL_IO>
ether 82:86:03:e1:3c:01 
media: autoselect <full-duplex>
status: inactive
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=460<TSO4,TSO6,CHANNEL_IO>
ether 82:86:03:e1:3c:00 
media: autoselect <full-duplex>
status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether aa:68:1b:19:6c:96 
inet6 fe80::a868:1bff:fe19:6c96%awdl0 prefixlen 64 scopeid 0xd 
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
llw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether aa:68:1b:19:6c:96 
inet6 fe80::a868:1bff:fe19:6c96%llw0 prefixlen 64 scopeid 0xe 
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::4290:fd85:5af0:d867%utun1 prefixlen 64 scopeid 0xf 
nd6 options=201<PERFORMNUD,DAD>
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
inet6 fe80::62de:4ba9:6a09:390d%utun2 prefixlen 64 scopeid 0x10 
nd6 options=201<PERFORMNUD,DAD>
utun4: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::5e09:cf0d:6772:2135%utun4 prefixlen 64 scopeid 0x13 
nd6 options=201<PERFORMNUD,DAD>
utun5: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::5a8e:6e18:d898:171b%utun5 prefixlen 64 scopeid 0x14 
nd6 options=201<PERFORMNUD,DAD>
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1400

================================================================================

Non-Apple kexts that are loaded:

Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>

================================================================================

Quit Log:

2020-12-29 15:52:51.093177 applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes)
2020-12-29 15:52:51.095881 shutDownTunnelblick: started.
2020-12-29 15:52:51.096613 shutDownTunnelblick: Starting cleanup.
2020-12-29 15:52:51.097067 cleanup: Entering cleanup
2020-12-29 15:52:51.105106 synchronized user defaults
2020-12-29 15:52:51.953251 shutDownTunnelblick: Cleanup finished.
2020-12-29 15:52:51.953876 Finished shutting down Tunnelblick; allowing termination

================================================================================

Console Log:

2020-12-29 09:53:35.605649 tunnelblickd[17771] Status = 252 from tunnelblick-helper command 'compareShadowCopy XO copy'
2020-12-29 09:53:35.621030 Tunnelblick[948] tunnelblickd status from compareShadowCopy: 252
2020-12-29 09:53:41.773502 Tunnelblick[948] Tunnelblick needs to perform an action that requires a computer administrator's authorization.
2020-12-29 09:53:41.773574 Tunnelblick[948] Beginning installation or repair
2020-12-29 09:53:41.873972 Tunnelblick[948] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2020-12-29 09:53:41.831811. 3 arguments: 0x0001
                                            /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       getuid() = 503; getgid() = 20; geteuid() = 0; getegid() = 20
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick'; owner = 503:80; permissions = 488
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations'; owner = 503:80; permissions = 488
                                       Copied /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                           to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk.temp
                                       Renamed /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk.temp
                                            to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk and its contents from 503:80 to 0:0
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents/Resources
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents/Resources/config.ovpn
                                       Tunnelblick installer finished without error
2020-12-29 09:53:41.874110 Tunnelblick[948] Created or updated secure (shadow) copy of configuration file /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
2020-12-29 09:53:45.515348 Tunnelblick[948] Connecting XO copy using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 09:54:09.630072 Tunnelblick[948] Set 'expect disconnect 1 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO copy-Dtblk-SContents-SResources'
2020-12-29 09:54:37.912263 Tunnelblick[948] Cleared 'expect disconnect 0 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO copy-Dtblk-SContents-SResources'
2020-12-29 09:54:38.410289 Tunnelblick[948] Connecting XO copy using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 10:01:06.688858 Tunnelblick[948] LoginWindowController: didWakeUpFromSleepHandler: requesting redisplay of login window
2020-12-29 10:01:08.113496 Tunnelblick[948] connect: but XO copy is not disconnected
2020-12-29 10:02:02.637144 Tunnelblick[948] Can't find Keychain item to delete: service = 'Tunnelblick-Auth-XO copy'; account = 'username'; status was -25300: 'The specified item could not be found in the keychain.'
2020-12-29 10:02:02.637326 Tunnelblick[948] Can't find Keychain item to delete: service = 'Tunnelblick-Auth-XO copy'; account = 'password'; status was -25300: 'The specified item could not be found in the keychain.'
2020-12-29 10:03:45.781737 Tunnelblick[948] Connecting XO copy using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 10:06:16.234553 Tunnelblick[948] Set 'expect disconnect 1 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO copy-Dtblk-SContents-SResources'
2020-12-29 10:07:16.488174 Tunnelblick[948] Tunnelblick needs to perform an action that requires a computer administrator's authorization.
2020-12-29 10:07:16.488268 Tunnelblick[948] Beginning installation or repair
2020-12-29 10:07:16.723688 Tunnelblick[948] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2020-12-29 10:07:16.582813. 2 arguments: 0x2001
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       getuid() = 503; getgid() = 20; geteuid() = 0; getegid() = 20
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick'; owner = 503:80; permissions = 488
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations'; owner = 503:80; permissions = 488
                                       removed /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       removed /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Tunnelblick installer finished without error
2020-12-29 10:07:16.724015 Tunnelblick[948] Deleted '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk'
2020-12-29 10:07:37.370513 tunnelblickd[18077] Status = 252 from tunnelblick-helper command 'compareShadowCopy XO'
2020-12-29 10:07:37.531327 Tunnelblick[948] tunnelblickd status from compareShadowCopy: 252
2020-12-29 10:07:45.937101 tunnelblickd[18077] Status = 252 from tunnelblick-helper command 'compareShadowCopy XO'
2020-12-29 10:07:45.951055 Tunnelblick[948] tunnelblickd status from compareShadowCopy: 252
2020-12-29 10:07:59.710341 Tunnelblick[948] Tunnelblick needs to perform an action that requires a computer administrator's authorization.
2020-12-29 10:07:59.710415 Tunnelblick[948] Beginning installation or repair
2020-12-29 10:07:59.847314 Tunnelblick[948] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2020-12-29 10:07:59.805145. 3 arguments: 0x0001
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk
                                       getuid() = 503; getgid() = 20; geteuid() = 0; getegid() = 20
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick'; owner = 503:80; permissions = 488
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations'; owner = 503:80; permissions = 488
                                       Copied /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk
                                           to /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk.temp
                                       Renamed /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk.temp
                                            to /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       Copied /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                           to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk.temp
                                       Renamed /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk.temp
                                            to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk and its contents from 503:80 to 0:0
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents/Resources
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk/Contents/Resources/config.ovpn
                                       Created secure (shadow) copy of XO copy.tblk
                                       Tunnelblick installer finished without error
2020-12-29 10:07:59.864112 Tunnelblick[948] Can't find Keychain item to delete: service = 'Tunnelblick-Auth-XO copy'; account = 'username'; status was -25300: 'The specified item could not be found in the keychain.'
2020-12-29 10:07:59.880734 Tunnelblick[948] Can't find Keychain item to delete: service = 'Tunnelblick-Auth-XO copy'; account = 'password'; status was -25300: 'The specified item could not be found in the keychain.'
2020-12-29 10:08:32.564457 Tunnelblick[948] Tunnelblick needs to perform an action that requires a computer administrator's authorization.
2020-12-29 10:08:32.564598 Tunnelblick[948] Beginning installation or repair
2020-12-29 10:08:32.796617 Tunnelblick[948] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2020-12-29 10:08:32.651570. 2 arguments: 0x2001
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       getuid() = 503; getgid() = 20; geteuid() = 0; getegid() = 20
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick'; owner = 503:80; permissions = 488
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations'; owner = 503:80; permissions = 488
                                       removed /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk
                                       removed /Library/Application Support/Tunnelblick/Users/ZZPORS/XO copy.tblk
                                       Tunnelblick installer finished without error
2020-12-29 10:08:32.796967 Tunnelblick[948] Deleted '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO copy.tblk'
2020-12-29 10:08:50.231294 tunnelblickd[18077] Status = 252 from tunnelblick-helper command 'compareShadowCopy XO'
2020-12-29 10:08:50.259224 Tunnelblick[948] tunnelblickd status from compareShadowCopy: 252
2020-12-29 10:08:56.780176 Tunnelblick[948] Tunnelblick needs to perform an action that requires a computer administrator's authorization.
2020-12-29 10:08:56.780280 Tunnelblick[948] Beginning installation or repair
2020-12-29 10:08:56.906741 Tunnelblick[948] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2020-12-29 10:08:56.871388. 3 arguments: 0x0001
                                            /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk
                                            /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk
                                       getuid() = 503; getgid() = 20; geteuid() = 0; getegid() = 20
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick'; owner = 503:80; permissions = 488
                                       Created or checked '/Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations'; owner = 503:80; permissions = 488
                                       Copied /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk
                                           to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk.temp
                                       Renamed /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk.temp
                                            to /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk
                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk and its contents from 503:80 to 0:0
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents
                                       Changed permissions from 750 to 755 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/ZZPORS/XO.tblk/Contents/Resources/config.ovpn
                                       Tunnelblick installer finished without error
2020-12-29 10:08:56.906842 Tunnelblick[948] Created or updated secure (shadow) copy of configuration file /Users/ZZPORS/Library/Application Support/Tunnelblick/Configurations/XO.tblk
2020-12-29 10:09:09.263226 Tunnelblick[948] Connecting XO using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 10:09:17.639581 Tunnelblick[948] Set 'expect disconnect 1 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO-Dtblk-SContents-SResources'
2020-12-29 10:20:45.897954 Tunnelblick[948] cleanup: Entering cleanup
2020-12-29 10:20:45.908287 Tunnelblick[948] synchronized user defaults
2020-12-29 10:20:46.192807 Tunnelblick[948] Set 'expect disconnect 0 ALL'
2020-12-29 10:20:46.743783 Tunnelblick[948] Finished shutting down Tunnelblick; allowing termination
2020-12-29 10:20:54.522230 Tunnelblick[18647] Tunnelblick: macOS 10.16.0; Tunnelblick 3.8.5beta02 (build 5620)
2020-12-29 10:20:54.628020 Tunnelblick[18647] Warning: preferences contain unknown preference 'NSWindow Frame NSSpellCheckerSubstitutionsPanel2'
2020-12-29 10:20:54.628186 Tunnelblick[18647] Warning: preferences contain unknown preference 'NSStatusItem Preferred Position Item-0'
2020-12-29 10:20:56.285836 Tunnelblick[18647] Sparkle: ===== Tunnelblick.app =====
2020-12-29 10:20:56.287074 Tunnelblick[18647] Sparkle: Verified appcast signature
2020-12-29 10:21:07.305691 Tunnelblick[18647] Cleared 'expect disconnect 0 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO-Dtblk-SContents-SResources'
2020-12-29 10:21:07.797176 Tunnelblick[18647] Connecting XO using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 10:21:14.032010 Tunnelblick[18647] Set 'expect disconnect 1 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO-Dtblk-SContents-SResources'
2020-12-29 15:51:06.411189 Tunnelblick[18647] Removing *-skipWarningAboutDownroot
2020-12-29 15:51:06.411313 Tunnelblick[18647] Removing *-skipWarningAboutNoTunOrTap
2020-12-29 15:51:06.411401 Tunnelblick[18647] Removing *-skipWarningUnableToToEstablishOpenVPNLink
2020-12-29 15:51:06.411482 Tunnelblick[18647] Removing *-skipWarningThatCannotConnectBecauseOfOpenVPNOptions
2020-12-29 15:51:06.411565 Tunnelblick[18647] Removing *-skipWarningThatNotUsingSpecifiedOpenVPN
2020-12-29 15:51:06.411643 Tunnelblick[18647] Removing *-skipWarningThatCannotConnectBecauseOfOpenVPNOptionConflicts
2020-12-29 15:51:06.411727 Tunnelblick[18647] Removing *-skipWarningThatMayNotConnectInFutureBecauseOfOpenVPNOptions
2020-12-29 15:52:51.096995 Tunnelblick[18647] cleanup: Entering cleanup
2020-12-29 15:52:51.105049 Tunnelblick[18647] synchronized user defaults
2020-12-29 15:52:51.389738 Tunnelblick[18647] Set 'expect disconnect 0 ALL'
2020-12-29 15:52:51.953796 Tunnelblick[18647] Finished shutting down Tunnelblick; allowing termination
2020-12-29 15:52:56.662056 com.apple.xpc.launchd[1] Coalition Cache Hit: app<application.net.tunnelblick.tunnelblick.10695899.10695905(503)> [5457]
2020-12-29 15:52:56.733477 Tunnelblick[20978] Tunnelblick: macOS 10.16.0; Tunnelblick 3.8.5beta02 (build 5620)
2020-12-29 15:52:56.841106 Tunnelblick[20978] Warning: preferences contain unknown preference 'NSWindow Frame NSSpellCheckerSubstitutionsPanel2'
2020-12-29 15:52:56.841409 Tunnelblick[20978] Warning: preferences contain unknown preference 'NSStatusItem Preferred Position Item-0'
2020-12-29 15:52:58.387772 Tunnelblick[20978] Sparkle: ===== Tunnelblick.app =====
2020-12-29 15:52:58.388594 Tunnelblick[20978] Sparkle: Verified appcast signature
2020-12-29 15:53:20.624263 Tunnelblick[20978] Connecting XO using OpenVPN 2.4.10 - OpenSSL v1.1.1i which has deprecated options. To see them, reset disabled warnings on the 'Preferences' panel of the 'VPN Details' window and then try again.
2020-12-29 15:53:24.477839 Tunnelblick[20978] Set 'expect disconnect 1 -SLibrary-SApplication Support-STunnelblick-SUsers-SZZPORS-SXO-Dtblk-SContents-SResources'

Tunnelblick developer

unread,
Dec 29, 2020, 11:54:46 AM12/29/20
to tunnelblick-discuss
I think this is caused by recent versions of OpenSSL (which OpenVPN uses for cryptography) being more picky about the format of date fields.

You can probably avoid the problem by telling Tunnelblick to use "OpenVPN 2.3.18 - OpenSSL 1.0.2u, which may not be quite so picky.

Whether or not this lets you connect, you should get an updated configuration file with updated certificates. I don't know which of the certificates (the CA (Certificate Authority) certificate or the CERT (OpenVPN server's) certificate is causing the problem. If you can look at the info in the certificates, the problem is the one with serial number 17702460327850242852.

Raúl Uría

unread,
Dec 29, 2020, 1:32:04 PM12/29/20
to tunnelblick-discuss
With OpenVPN 2.3.18 - OpenSSL 1.0.2u, get this error: "OpenSSL: error:140E6118:SSL routines:SSL_CIPHER_PROCESS_RULESTR:invalid command"

The funny thing with certificates is that neither of two seems to be the one causing the error ! Getting available certs on the server (openssl s_client -showcerts -connect XX.YY.ZZ.WW:443) any cert with serial 17702460327850242852 is found, I am very confused about this.

Tunnelblick developer

unread,
Dec 29, 2020, 1:38:24 PM12/29/20
to tunnelblick-discuss
Sorry, you'll have to get help from someone who knows more about OpenSSL than me.
Reply all
Reply to author
Forward
0 new messages