Docker-transmission-openvpn: Giganews TLS Errors

[Jafalex]

About two weeks ago, this container was happily working using the Giganews config. Today, I noticed the logs reported the errors below. Maybe the Giganews ovpn files are outdated?

docker-compose.yml

  transmission:
    image: haugene/transmission-openvpn:latest-armhf
    cap_add:
      - NET_ADMIN
    devices:
      - "/dev/net/tun"
    restart: always
    ports:
      - "9091:9091"
      - "8889:8888"
    dns:
      - 8.8.8.8
      - 8.8.4.4
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /mnt/downloads/:/data
    environment:
      - OPENVPN_PROVIDER=GIGANEWS
      - OPENVPN_USERNAME=
      - OPENVPN_PASSWORD=
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - LOCAL_NETWORK=192.168.88.0/24
      - OPENVPN_CONFIG=New Zealand

Logs

NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
TCP/UDP: Preserving recently used remote address: [AF_INET]123.456.789.101:443
TCP/UDP: Preserving recently used remote address: [AF_INET]123.456.789.101:443
Socket Buffers: R=[163840->163840] S=[163840->163840]
UDP link local: (not bound)
UDP link remote: [AF_INET]123.456.789.101:443
TLS: Initial packet from [AF_INET] 123.456.789.101:443, sid=60788b7b 11401fb4
VERIFY ERROR: depth=2, error=self signed certificate in certificate chain: C=CH, ST=Lucerne, L=Meggen, O=Golden Frog GmbH, CN=Golden Frog GmbH Root CA, [email protected]
OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
TLS_ERROR: BIO read tls_read_plaintext error
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
SIGUSR1[soft,tls-error] received, process restarting
Restart pause, 40 second(s)

Host is Raspbian on a Rpi4.

[haugene]

Yes, they seem to be outdated. More specifically they have changed certificate.
I've updated the certificate on the dev branch now, so you can try running the :dev tag and see if that works.

Closing this, follow up in #1121

[Jafalex]

Thanks! Guessing that's not going to work with :latest-armhf, so best to wait for production release I assume? Cheers again :)

[haugene]

There actually is a :dev-armhf that you can use in the mean time as well.