Re: OpenSSL: error:0308010C:digital envelope routines::unsupported while reading CRL

Hi,

On 27/11/2023 11:49, Gert Doering wrote:
> Hi,
> 
> On Mon, Nov 27, 2023 at 10:47:17AM +0100, Aleksandar Ivanisevic wrote:
>> 2023-11-26T08:33:40.015885+01:00 xxx openvpn[7996]: xxx:6013 OpenSSL: error:0308010C:digital envelope routines::unsupported
> 
> So this sounds like "the CRL is built using old algorithms" (MD5?), and
> it might work if you do "providers legacy default" in the server config.
> 
>> 2023-11-26T08:33:40.016558+01:00 xxx openvpn[7996]: xxx:6013 OpenSSL: error:0480006C:PEM routines::no start line
>> 2023-11-26T08:33:40.017053+01:00 xxx openvpn[7996]: xxx:6013 CRL: cannot read CRL from file /config/vpn/my.crl
>> 2023-11-26T08:33:40.017486+01:00 xxx openvpn[7996]: xxx:6013 CRL: loaded 1 CRLs from file /config/vpn/my.crl
> 
> Now *this* sounds like OpenVPN is lying, which would be a serious bug...

we must be iterating twice. there is no way to get the counter increased 
to 1 if an error was returned in the first place.
Maybe we are getting an empty CRL the first time.

Although I can't understand how we are getting "no start line" and then 
"CRL: cannot read CRL from file". The first error should imply an early 
exit if the counter is 1.

@Aleksandar would it be an option for you to send your CRL over so that 
we can replicate the issue here (also privately)?

Cheers,

-- 
Antonio Quartulli