OpenVPN on LibreELEC (Krypton) v7.90.004 ALPHA on a Raspberry Pi 2

outcave · September 1, 2016 at 6:07 PM

Hi.
I'm trying to connect to Hide.me VPN service with OpenVPN on LibreELEC (Krypton) v7.90.004 ALPHA on a Raspberry Pi 2.
I have this error:

Code

LibreELEC:~/.kodi/addons/service.vpn.manager/HideMe # openvpn Milan\ \(UDP\).ovpn
Wed Aug 31 20:01:22 2016 OpenVPN 2.3.11 armv7ve-libreelec-linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [IPv6] built on Aug  8 2016
Wed Aug 31 20:01:22 2016 library versions: LibreSSL 2.3.5, LZO 2.09
Wed Aug 31 20:01:22 2016 WARNING: file '/storage/.kodi/addons/service.vpn.manager/HideMe/pass.txt' is group or others accessible
Wed Aug 31 20:01:22 2016 WARNING: file '/storage/.kodi/addons/service.vpn.manager/HideMe/ta.key' is group or others accessible
Wed Aug 31 20:01:22 2016 Control Channel Authentication: using '/storage/.kodi/addons/service.vpn.manager/HideMe/ta.key' as a OpenVPN static key file
Wed Aug 31 20:01:22 2016 UDPv4 link local: [undef]
Wed Aug 31 20:01:22 2016 UDPv4 link remote: [AF_INET]159.122.133.197:4000
Wed Aug 31 20:01:22 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Aug 31 20:01:22 2016 VERIFY ERROR: depth=2, error=format error in certificate's notAfter field: C=MY, ST=Wilayah Persekutuan, L=Labuan, O=eVenture Limited, OU=Certificate Authority, CN=Hide.Me Root CA
Wed Aug 31 20:01:22 2016 OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Aug 31 20:01:22 2016 TLS_ERROR: BIO read tls_read_plaintext error
Wed Aug 31 20:01:22 2016 TLS Error: TLS object -> incoming plaintext read error
Wed Aug 31 20:01:22 2016 TLS Error: TLS handshake failed
Wed Aug 31 20:01:22 2016 SIGUSR1[soft,tls-error] received, process restarting

Display More

May be some Root CA missed in LibreSSL?

Just for your info, with OpenELEC 6.0.3 and with LibreELEC (Jarvis 16.1) v7.0.2 I was able to connect with the exactly same .ovpn file.

I hope in your help.
Thanks.

**chewitt** · September 1, 2016 at 7:24 PM Official Post

The error says the certificate notAfter time is invalid, so either there is bad data in the certificate (unlikely if the same cert works on 7.0.2) or maybe the device date/time is incorrect which causes an odd result.

outcave · September 1, 2016 at 8:03 PM

Quote from chewitt

The error says the certificate notAfter time is invalid, so either there is bad data in the certificate (unlikely if the same cert works on 7.0.2) or maybe the device date/time is incorrect which causes an odd result.

The DATE and TIME of RPI2 are correct (via NTP)

outcave · September 2, 2016 at 11:14 AM

Quote from outcave

The DATE and TIME of RPI2 are correct (via NTP)

Hi again.
The problem is LibreSSL 2.3.x (inside LibreELEC v7.90.004 ALPHA and next versions) that on the Raspberry Pi (and also on all 32 bit operating system) will not works with certificate that will expires after 2038 due to "Year 2038 bug".

See here: LibreELEC Testbuilds for RaspberryPi (Kodi 17.0)

Hope in a FIX.

adiadore · September 11, 2016 at 2:01 PM

Hi outcave,

I am struggling with the same problem. Did you have any success with contacting hide.me?
I already contacted my vpn IPVanish and sadly they can not provide me with a crt ending before y2038..
so i am looking for one who can but at the moment without success

hackbird · September 11, 2016 at 4:55 PM

Hello,

for an long time i got the same problems on hide.me

On the openelec forum there is an addon developer "zomboided".
He create an vpnmanager which got a lot of vpn provider inside.

Here is the thread:
OpenELEC Mediacenter - OpenELEC Forum - VPN Manager for OpenVPN (1/63)

I was a long time in contact with him to gettin work with hide.me. But without success. Provider says the system wont working with this
addon.

Now i am at torguard and all working perfect.

IPVanish are working too with this addon.

Read please the thread of zomboided. There is an good tut how it works.

P.S. addon works in libreelec too. I got it on Krypton. Works perfect

adiadore · September 11, 2016 at 5:51 PM

hey,
im using the vpnmanager from zomboided, but after the krypton update ipvanish couldnt connect any more.
They told me they can not change their certificate.. I found AirVPN today and theirs is only valid until 2024 so everything it working again now

outcave · September 12, 2016 at 10:57 AM

Hi guys.
Please no make confusion .

The Certificate problem is on all versions of LibreELEC v7.90.004 ALPHA and next versions because these versions has inside the newest version of LibreSSL. These new versions of LibreSSL does not work with Certificate that will expire after year 2038 on 32 bit operating system (such as Raspberry Pi 2). It seems that LibreSSL does not want to solve this issue and it seems that also LibreELEC does not want to switch to OpenSSL (OpenSSL works fine also on 32 bit operating system, so OpenSSL is OK on Raspberry Pi).

So the problem is not Hide.me, is not IPVanish, is not VPNManager addon. The problem is only LibreSSL on 32 bit operating system.

Now you have various way to follow to solve the issue:

1. Contact your VPN "provider" and ask to have a new Certificate (CA) that will expire before 2038. Hide.me is "friendly" and I'm quite sure that will give you a new Certificate if you will explain the problem. So open a Support Ticket on Hide.me website.
2. Contact LibreELEC team to ask to use OpenSSL instead to use LibreSSL (see these my posts and later: LibreELEC Testbuilds for RaspberryPi (Kodi 17.0))
3. Contact LibreSSL to ask to solve the issue (I think this is useless, see here: Year 2038 bug on LibreSSL 32bit regression between 2.2.x and 2.3.x · Issue #207 · libressl-portable/portable · GitHub)
4. Use a more old version of LibreELEC (version 7.0.2 works fine because it uses an old version of LibreSSL) or use OpenELEC 6.0.3 that uses OpenSSL

Actually I'm using LibreELEC version 7.0.2 with the last version of VPNManager addon made by zomboided and I can connect to Hide.me VPN without problems.

About Hide.me, there WAS a problem on routing table on OpenELEC / LibreELEC (VPN was connected but all traffic does not go via VPN) now solved since VPNManager addon version 1.9 ("redirect-gateway def1" option was added into VPNManager addon).

More info about my analysis on routing table for Hide.me see this my post: OpenELEC Mediacenter - OpenELEC Forum - VPN Manager for OpenVPN (38/63)

Enjoy.

Grimson · September 12, 2016 at 1:50 PM

Quote from outcave

So the problem is not Hide.me, is not IPVanish, is not VPNManager addon. The problem is only LibreSSL on 32 bit operating system.

Actually those providers are a big part of a problem. VPNs are meant to increase security, but certificates with a lifetime spanning decades are ridiculously stupid in a security context.

About OpenSSL, that is one big pile of a shitty mess and a gigantic bug-fest. Moving away from OpenSSL was one of the best decisions the LE developers have made, so far.

adiadore · September 12, 2016 at 2:27 PM

Quote from outcave

Hi guys.
Please no make confusion .

The Certificate problem is on all versions of LibreELEC v7.90.004 ALPHA and next versions because these versions has inside the newest version of LibreSSL. These new versions of LibreSSL does not work with Certificate that will expire after year 2038 on 32 bit operating system (such as Raspberry Pi 2). It seems that LibreSSL does not want to solve this issue and it seems that also LibreELEC does not want to switch to OpenSSL (OpenSSL works fine also on 32 bit operating system, so OpenSSL is OK on Raspberry Pi).

So the problem is not Hide.me, is not IPVanish, is not VPNManager addon. The problem is only LibreSSL on 32 bit operating system.

Now you have various way to follow to solve the issue:

1. Contact your VPN "provider" and ask to have a new Certificate (CA) that will expire before 2038. Hide.me is "friendly" and I'm quite sure that will give you a new Certificate if you will explain the problem. So open a Support Ticket on Hide.me website.
2. Contact LibreELEC team to ask to use OpenSSL instead to use LibreSSL (see these my posts and later: LibreELEC Testbuilds for RaspberryPi (Kodi 17.0))
3. Contact LibreSSL to ask to solve the issue (I think this is useless, see here: Year 2038 bug on LibreSSL 32bit regression between 2.2.x and 2.3.x · Issue #207 · libressl-portable/portable · GitHub)
4. Use a more old version of LibreELEC (version 7.0.2 works fine because it uses an old version of LibreSSL) or use OpenELEC 6.0.3 that uses OpenSSL

Actually I'm using LibreELEC version 7.0.2 with the last version of VPNManager addon made by zomboided and I can connect to Hide.me VPN without problems.

About Hide.me, there WAS a problem on routing table on OpenELEC / LibreELEC (VPN was connected but all traffic does not go via VPN) now solved since VPNManager addon version 1.9 ("redirect-gateway def1" option was added into VPNManager addon).

More info about my analysis on routing table for Hide.me see this my post: OpenELEC Mediacenter - OpenELEC Forum - VPN Manager for OpenVPN (38/63)

Enjoy.

Display More

i understood your problem, but im telling you now, i switched from ipvanish to another vpn (they used a >2038 expiry date and couldnt change it) and it works again on LibreELEC v7.90.005 and on the latest kodi 17 millhouse alphas

i gathered some information about other vpn's if you want to leave hide.me

these are all in the openvpn manager:
vpn unlimited - openvpn cert valid until 2023
ibVPN - 2020
celo - every 2 years
AirVPN - 2024

marcel45143 · September 12, 2016 at 2:45 PM

LibreELEC v7.90.005
I have Cyberghost Certificate 2026 and not working

Working

hackbird · September 12, 2016 at 2:49 PM

On 7.90.005 provider "torguard" with vpn manager works on my system without any problems.

outcave · September 12, 2016 at 6:00 PM

Quote from adiadore

i understood your problem, but im telling you now, i switched from ipvanish to another vpn (they used a >2038 expiry date and couldnt change it) and it works again on LibreELEC v7.90.005 and on the latest kodi 17 millhouse alphas

i gathered some information about other vpn's if you want to leave hide.me

these are all in the openvpn manager:
vpn unlimited - openvpn cert valid until 2023
ibVPN - 2020
celo - every 2 years
AirVPN - 2024

I don't want to leave Hide.me, now I'm using it without problems with LibreELEC version 7.0.2. For the future? May be I will compile OpenSSL and overwrite to LibreSSL

**chewitt** · September 12, 2016 at 6:38 PM Official Post

Quote from outcave

I don't want to leave Hide.me, now I'm using it without problems with LibreELEC version 7.0.2. For the future? May be I will compile OpenSSL and overwrite to LibreSSL

It will fix your VPN, but will also break binary compatibility with everything else that uses SSL (and expects LibreSSL). Not impossible, but not a quick change either. You energies would be more productive figuring out the patch/hack for LibreSSL ..

outcave · September 12, 2016 at 7:04 PM

Quote from chewitt

It will fix your VPN, but will also break binary compatibility with everything else that uses SSL (and expects LibreSSL). Not impossible, but not a quick change either. You energies would be more productive figuring out the patch/hack for LibreSSL ..

Should I find a patch for LibreSSL? And how? LibreSSL actually do not want to resolve it.... How Can I do?
I expect LibreELEC should take charge and find a solution for it! As it is now LibreELEC do not "work" for certificate with year after 2038: it's a fact...

gcstang · October 24, 2016 at 6:09 PM

Quote from adiadore

hey,
im using the vpnmanager from zomboided, but after the krypton update ipvanish couldnt connect any more.
They told me they can not change their certificate.. I found AirVPN today and theirs is only valid until 2024 so everything it working again now

Sorry to bug you but do you have instructions on how to get AirVPN working on LibreELEC ? I just installed it and wanted to get my AirVPN connection setup but I'm not having much luck in finding how to set this up on LibreELEC for my pi3.

Thank you

davo22 · February 7, 2017 at 11:55 AM

Also got the same issue with my VPN [certificate expiring in 2040] . I asked them if they can provide a certificate that is a bit shorter.

In meantime, is possible to switch temporarily to openssl ? How difficult for me would be to create a patched version that uses openssl instead of libresssl [considering that I have never built the libreelec but I know linux ]?

WebBuddha · April 21, 2017 at 8:49 AM

Any further updates on this? I've got the same error with the certificate of the VPN Service provider Windscribe.
It's still exists on LibreELEC-RPi2.arm-8.0.1.img.gz