gluetun: Certificate problem with OpenVPN on 32 bit systems
Host OS (approximate answer is fine too): Raspberry PI OS -Linux pi4 5.4.83-v7l+ #1379 SMP Mon Dec 14 13:11:54 GMT 2020 armv7l
Is this urgent?: No but PIA doesn’t seem work at the moment - this version and an almost identical Docker-compose.yml works fine with NordVPN. Problem started sometime in the afternoon (CET) on 26.1.2021.
What VPN provider are you using: PIA
What is the version of the program latest, as of 1300 CET 27.01.2021 - “Running version latest built on 2020-03-13T01:30:06Z (commit d0f678c)”
What’s the problem 🤔
cert verifcation at tunnel setup fails:
2021-01-27T13:36:51.772+0100 INFO firewall: setting VPN connection through firewall...
2021-01-27T13:36:51.782+0100 INFO openvpn configurator: starting openvpn
2021-01-27T13:36:51.790+0100 INFO openvpn: DEPRECATED OPTION: --cipher set to 'aes-256-cbc' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'aes-256-cbc' to --data-ciphers or change --cipher 'aes-256-cbc' to --data-ciphers-fallback 'aes-256-cbc' to silence this warning.
2021-01-27T13:36:51.790+0100 INFO openvpn: OpenVPN 2.5.0 armv7-alpine-linux-musleabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 26 2020
2021-01-27T13:36:51.790+0100 INFO openvpn: library versions: OpenSSL 1.1.1i 8 Dec 2020, LZO 2.10
2021-01-27T13:36:51.793+0100 INFO openvpn: CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
2021-01-27T13:36:51.793+0100 INFO openvpn: *cert code*=
2021-01-27T13:36:51.793+0100 INFO openvpn: -----END X509 CRL-----
2021-01-27T13:36:51.794+0100 INFO openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]156.146.62.194:1197
2021-01-27T13:36:51.794+0100 INFO openvpn: UDP link local: (not bound)
2021-01-27T13:36:51.794+0100 INFO openvpn: UDP link remote: [AF_INET]156.146.62.194:1197
2021-01-27T13:36:51.833+0100 INFO openvpn: VERIFY ERROR: depth=0, error=format error in CRL's lastUpdate field: C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=zurich407, name=zurich407, serial=94548133526
2021-01-27T13:36:51.833+0100 INFO openvpn: OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2021-01-27T13:36:51.834+0100 INFO openvpn: TLS_ERROR: BIO read tls_read_plaintext error
2021-01-27T13:36:51.834+0100 INFO openvpn: TLS Error: TLS object -> incoming plaintext read error
2021-01-27T13:36:51.834+0100 INFO openvpn: TLS Error: TLS handshake failed
2021-01-27T13:36:51.834+0100 INFO openvpn: SIGTERM[soft,tls-error] received, process exiting
2021-01-27T13:36:51.835+0100 ERROR openvpn: <nil>
2021-01-27T13:36:51.835+0100 INFO openvpn: retrying in 15s
What are you using to run your container?: Docker Compose
Please also share your configuration file:
pia:
# image: qmcgaw/private-internet-access:v3.0.1
# image: qmcgaw/private-internet-access:v3.1.0
# image: qmcgaw/private-internet-access:shadowsocks
# image: qmcgaw/private-internet-access:v3.2.0-rc1
# image: qmcgaw/private-internet-access:v3.2.0-rc2
# image: qmcgaw/private-internet-access
image: qmcgaw/gluetun
container_name: pia
restart: unless-stopped
cap_add:
- NET_ADMIN
network_mode: bridge
# init: true
ports:
- 8888:8888/tcp # tinyproxy
- 8388:8388/tcp # Shadowsocks
- 8388:8388/udp # Shadowsocks
- 8000:8000/tcp # Built-in HTTP control server
- 6789:6789/tcp # nzbget UI
- 5076:5076/tcp # nzbhydra2 UI
- 4040:4040/tcp # booksonic UI
# - 4045:4045/tcp # airsonic UI
- 8112:8112 # deluge web UI
- 9117:9117 # jackett UI
- 5299:5299 # lazylibrarian UI
- 2202:2202 # ubooquity UI
- 2203:2203 # ubooquity admin
- 8090:8090 # mylar UI
# - 8080:8080 # calibre desktop UI
# - 8081:8081 # calibre webserver UI
- 8080:8080 # komga
- 80:80 # Heimdall
- 443:443 # Heimdall
- 8686:8686 # lidarr
environment:
- VPNSP=private internet access
# - USER=xxx
# - PASSWORD=yyy
- OPENVPN_USER=<PIA UID>
- OPENVPN_PASSWORD=<PIA PW>
# - PROTOCOL=udp
- OPENVPN_VERBOSITY=1 #1-6
- OPENVPN_ROOT=no
- TZ=${TZ}
- UID=${PUID}
- GID=${PGID}
# - REGION=Switzerland
- REGION=Sweden,Denmark,Austria,Switzerland,Netherlands
# - REGION=Sweden
# - REGION=Denmark
# - REGION=Austria
# - REGION=DE Frankfurt
# - REGION=DE Berlin
# - PIA_ENCRYPTION=strong
- DOT=on
- DOT_PROVIDERS=cloudflare,google,libredns #google,quad9,securedns,libredns,cloudflare
- DOT_IPV6=off
- DOT_CACHING=on
- DOT_VERBOSITY=1 #1-5
- DOT_VERBOSITY_DETAILS=0
- BLOCK_MALICIOUS=on
- BLOCK_SURVEILLANCE=on
- BLOCK_ADS=off
- DNS_PLAINTEXT_ADDRESS=1.1.1.1
- DNS_UPDATE_PERIOD=12h
- SHADOWSOCKS=on
- SHADOWSOCKS_LOG=on
- SHADOWSOCKS_PASSWORD=<password>
- SHADOWSOCKS_PORT=8388
- HTTPPROXY=on
- HTTPPROXY_PORT=8888
- HTTPPROXY_USER=<UID>
- HTTPPROXY_PASSWORD=<password>
# - EXTRA_SUBNETS=192.x.x.x/x
- FIREWALL_OUTBOUND_SUBNETS=192.x.x.x/x
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 38 (16 by maintainers)
Alright it’s fixed in v3.12.1 and :latest for now. Thanks for taking the time to debug everyone. I’ll comment back here when I get a reply from the alpine openvpn maintainer and we can do some more testing.
:pia-fixnow works for me. Thanks! (Even if it may be just an interim fix.) You’re right. It does seem to be an alpine 3.13 issue with armv7. I’m running it on a Raspberry Pi.qmcgaw/gluetun:latestand releases afterqmcgaw/gluetun:v3.16.0have/will have Openvpn 2.5.1 and Alpine 3.13, so make sure to upgrade your host before pulling and running the container 😉This comment should fix it for raspberry Pis running 32 bit systems. I’ll re-update in the coming days to Alpine 3.13 & openvpn 2.5.0 so you may want to do it on your host 😉
Ok that’s probably the packages from 3.13 only working for alpine 3.13, we will stick everything back to alpine 3.12 for now until some of the packages get fixed.
So yeah the root of all this is now VERY likely due to that Alpine 3.13 time representation on 32 bit systems 😕
Yup, my x86 machine is indeed x86-64!
I might be the switch to openvpn 2.5.0 I think. It could well be PIA not supporting 2.5.0, there is that Reddit comment from their support 2 months ago I doubt the situation changed much.
Anyway great it works, I’ll merge all this and do release tags.
EDIT: I’ll try using alpine 3.13 with openvpn 2.4.9 first.