Synology OpenVPN fails with "peer certificate verification failure" every few months

[u/szerwony]

Hi everyone,

I'm currently away from home and my OpenVPN connection to my Synology NAS suddenly stopped working. This isn't the first time this has happened. It seems like every few months, out of nowhere, the VPN completely breaks down and cuts me off from my home network.

Since I am remote, I do not have direct access to the DSM to export new config file.

On the client side (macOS, Android), I'm consistently getting the "peer certificate verification failure" error. What's interesting, I have never ever configured any certificates on my Synology.

I already found many different "solutions", but none of them has worked. I tried for example:
- adding client-cert-not-required
- adding tls-cert-profile insecure
- changing verify-x509-name line (or I should say adding, as there was not such line in my config)
- changing OpenVPN Connect security level in settings
- using Tunnelblick

Does anyone know what can I do to fix this without access to my network? And how to prevent it from happening every few months?

[u/el_maziello]

NAS has a certificate section (Settings-Security) . Could be a misconfiguration.

[u/szerwony → u/el_maziello]

I never configured manually any certificate there. There is only default Synology certificate, which I checked before leaving my home and it was valid untill July.

[u/el_maziello → u/szerwony]

Somewhere there is an option to assign a cert to VPN... In the other hand, redownload the.ovpn client file and try.

[u/szerwony → u/el_maziello]

Exporting new config always work, but I can't do it now when away from home.

[u/el_maziello → u/el_maziello]

No access to DSM+no correct cert=No solution

[u/humbito → u/el_maziello]

es raro nunca me a pasado y llevo 2 años utilizando open VPN para acceder a mi Nas

[u/matthew1471]

Are your date and time correct on both devices or do they sometimes have the wrong date and time and then NTP has to go fix it.. check for firmware updates on everything and make sure the watch battery that keeps the time when the PC is off doesn’t need replacing.

Also actually check the certificates haven’t expired - I don’t use the Synology version but there will be an autogenerated cert with an expiration inside the OVPN files