Thank you for providing further info, Marcus.  This is exactly what we
needed in order to continue the investigation.

The following line from the Jammy log file caught my attention:

Apr 13 00:50:01 slim nm-openvpn[3337388]: OpenSSL: error:0A00018E:SSL
routines::ca md too weak

This is the reason OpenVPN is failing to connect.  This error happens
because OpenSSL 3.0 (which is the default OpenSSL version in Jammy) now
rejects certificates generated with legacy cryptographic algorithms,
which seems to be what you have there.  See:

https://wiki.openssl.org/index.php/OpenSSL_3.0#Legacy_Algorithms

The recommended fix for this issue is to regenerate your certificates
using stronger ciphers.  There are other workarounds available, but they
are unsafe and IMHO shouldn't be used in production.  I am leaving a few
links here that contain interesting discussions about this error:

https://www.snbforums.com/threads/default-openvpn-server-no-longer-works-with-openssl-3.75192/
https://github.com/openssl/openssl/issues/16650
https://forums.openvpn.net/viewtopic.php?t=23979 (old, but seems to be still 
applicable)

Having said all that, it looks very much like this is a local
configuration issue rather than a bug in the package, so I am marking
the bug as Incomplete again.  If you still believe this is a problem
with the openvpn, please mark this bug as New and provide a rationale
for us.

Thanks.

** Bug watch added: github.com/openssl/openssl/issues #16650
   https://github.com/openssl/openssl/issues/16650

** Changed in: openvpn (Ubuntu)
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1968629

Title:
  OpenVPN fails to start/connect

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1968629/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to