Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The current situation: I need to connect to an Astaro VPN box. Currently the only way to connect is using the Astaro Client for Windows. Normally any OpenVPN client (Viscosity, Tunnelblick, openvpn itself,...) can also be used to connect to an Astaro VPN box. Unfortunately this does not work on this special box. I get a message "VERIFY ERROR: could not extract CN from X509 subject string..." when connecting using a standard OpenVPN client.

A colleague tracked the problem down to the use of OpenSSL. The Astaro client uses an older OpenSSL library. He changed the OpenSSL lib of the OpenVPN client to the version used by the Astaro client and with this patch also the OpenVPN client could connect to the Astaro box.

I know that the maintainer of the Astaro box changed recently something on his box (updated to a new version and migrated all old accounts). Unfortunately he is not willingly to try to find the problem - all other users are using the Astaro client so from his view everything is ok.

My last idea is to find any way to install an older OpenVPN client that uses an older OpenSSL lib on my OSX machine. Is there any way to do this?

Short overview of my recent efforts:

  • Talked with a collegue about the problem. Using brew it could be possible to activate old recipes and install old version of a given package. Didn't try this at the moment.
  • Installed an old version of Ubuntu (8.04) inside a Virtualbox instance. Configured it to establish the vpn connection at startup and works as a router toward the secured network. Works fine and if there is no better solution I will stick with it.
  • Could not get any support from the vendor of the VPN appliance. They claiming to have also OSX clients but the operator or the installation I have to connect to wasn't able to provide it.
share|improve this question
How old OpenSSL library (version)? I won't recommend using old OpenSSL libs; even on client. Did you try old Tunnelblick versions, these may work fine: Theoretically, you may be able to use old OpenSSL libraries with current Tunnelblick by replacing them in the bundle (if in the bundle). You may also try to ask the Tunnelblick or Visosity authors to create custom versions of their products with the older libraries, but that's a long shot. I'd say, if possible ditch the service if they can't provide working OS X client. – lupincho May 1 '12 at 8:09
Tried different (older) versions of Tunnelblick. Either they are having the same problems with this particular connection or they are not running on OSX Lion. To ditch the service is not possible. It's a clients network I have to connect to. To go for a custom version of Tunnelblick or Viscosity is a good idea but as long as I have a workaround (the Ubuntu VM acting as a router) I will not go for it. @lupincho - thanks for the hints – magomi May 1 '12 at 19:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.