Cert verify fails since last update

[Amply666]

Hallo!!!
Since yesterday, after the last update the program started having problems, in the logs it has the following message:
error:0A000086:SSL routines::certificate verify failed

I try to ri download the SSL configuration file but work only in the olds versions (0.7.23) since 0.7.25 same configuration file don't work.

[tr3027]

you may have similar issue I had here. In my case the FAQ helped

[Amply666]

Thankyou,
I think the problem is similar, I read FAQ but I can't understand how you fix the problem.
You change somethink in configuration file (*.ovpn) or server side?

[schwabe]

From that message alone it is hard to figure out what your exact problem is. Try to provide a more complete log. But yes. It is probably related to stricter checks in OpenSSL 3.0

[Amply666]

Yes sure:
16:12 EVENT(Error): CERT_VERIFY_FAIL: OpenSSLContext::SSL::read_cleartext: BIO_read failed, cap=2576 status=-1: error:0A000086:SSL routines::certificate verify failed

I hope this can help you.
Thank you

[schwabe]

The lines above that line might contain more information why OpenSSL does not like the certificate.

[Quikfix73]

I have the exact same error (refer to my discussion below):

#1390

The best thing you can do is contact your VPN provider and have them provide you with a newer and stronger certificate in a revised OVPN file.

[Amply666]

OK thankyou, is possible in some way to "disable or go back" from new security level?
if I use OpenVPN for Android I have this problem but if I use OpenVPN the same certificate will work properly.

[schwabe]

See the FAQ. It explains this.

[Amply666]

If you really want to use old and broken certificates use the custom configuration option tls-cipher "DEFAULT:@SECLEVEL=0" under advanced configuration or as additional line in your imported configuration

I understood this but I find it difficult to find how to do it on the Android APP, I added the line indicated in the configuration file but I have not solved the problem

[Quikfix73]

Did you try it without the quotes? You need to remove any other tls-cipher line that currently exists in your OVPN configuration file and REPLACE it with this below without the quotes:

tls-cipher DEFAULT:@SECLEVEL=0

I tested it and it works fine for me.

In my test OVPN configuration file I had this line below:

tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-DSS-WITH-AES-256-CBC-SHA:TLS-RSA-WITH-AES-256-CBC-SHA

so I deleted this line above and replaced it with this line below (without the quotes):

tls-cipher DEFAULT:@SECLEVEL=0

and it works and connects fine now but personally I only did this as a test as I would NEVER connect to any VPN service without a STRONG certificate as you become more susceptible to hacking since you are now connecting without any certificate since the Security Level is now ZERO.