CERT: ERR_PARSING_FAILED

[q10nick]

Hello!
Android 14. New version apk.
Throws an error. Created the certificate on RouteOS (chr). Signed it. Connecting 2 mikrotik all works with these certificates. I add certificates to the program and nothing works. How to fix it?
`[2024-10-17 17:59:11.634] Establish VPN connection
[2024-10-17 17:59:11.716] CERT: ERR_PARSING_FAILED
[FAILED FILE]
cert_export_serv_VPN.p12

[STACK TRACE]
java.security.cert.CertificateException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR
at com.android.org.conscrypt.OpenSSLX509CertificateFactory.engineGenerateCertificate(OpenSSLX509CertificateFactory.java:303)
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:366)
at kittoku.osc.terminal.SSLTerminal.createTrustManagers(SSLTerminal.kt:109)
at kittoku.osc.terminal.SSLTerminal.establishSSL(SSLTerminal.kt:131)
at kittoku.osc.terminal.SSLTerminal.access$establishSSL(SSLTerminal.kt:62)
at kittoku.osc.terminal.SSLTerminal$initialize$2.invokeSuspend(SSLTerminal.kt:83)
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106)
at kotlinx.coroutines.internal.LimitedDispatcher.run(LimitedDispatcher.kt:42)
at kotlinx.coroutines.scheduling.TaskImpl.run(Tasks.kt:95)
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:570)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:750)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:677)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:664)
Caused by: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR
at com.android.org.conscrypt.OpenSSLX509CertificateFactory$Parser.generateItem(OpenSSLX509CertificateFactory.java:147)
at com.android.org.conscrypt.OpenSSLX509CertificateFactory.engineGenerateCertificate(OpenSSLX509CertificateFactory.java:301)
... 13 more
Caused by: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR
at com.android.org.conscrypt.OpenSSLX509Certificate.fromX509DerInputStream(OpenSSLX509Certificate.java:104)
at com.android.org.conscrypt.OpenSSLX509CertificateFactory$1.fromX509DerInputStream(OpenSSLX509CertificateFactory.java:253)
at com.android.org.conscrypt.OpenSSLX509CertificateFactory$1.fromX509DerInputStream(OpenSSLX509CertificateFactory.java:243)
at com.android.org.conscrypt.OpenSSLX509CertificateFactory$Parser.generateItem(OpenSSLX509CertificateFactory.java:137)
... 14 more
Caused by: java.lang.RuntimeException: error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR
at com.android.org.conscrypt.NativeCrypto.d2i_X509_bio(Native Method)
at com.android.org.conscrypt.OpenSSLX509Certificate.fromX509DerInputStream(OpenSSLX509Certificate.java:98)
... 17 more

[2024-10-17 17:59:11.732] Terminate VPN connection
`

[kittoku]

.p12 format, which includes a certificate and a private key, is not acceptable. Please try other formats like .pem, .der, .crt or .cer.

[q10nick]

Exported server certificate in pem format from Mikrotik. The result is 1 file with the crt extension. I copy it to my phone. I indicate in the program the folder where it lies. But now it gives an error:
[2024-10-18 16:57:54.920] OSC: ERR_UNEXPECTED
javax.net.ssl.SSLHandshakeException: Read error: ssl=0xb400007cac9ae518: Failure in SSL library, usually a protocol error
error:10000416:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_UNKNOWN (external/boringssl/src/ssl/tls_record.cc:592 0xb400007c6c99c9e0:0x00000003)
at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:356)
at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1127)

[kittoku]

Sorry, but I have nerver experienced that error. Please search for "SSLV3_ALERT_CERTIFICATE_UNKNOWN" and try something.

[JalalKhanSL]

I had the same issue,my server was using a self signed certificate, we solve it by signing the certificate with a trusted source.

[kobussch]

Apologies for reviving an old issue, but my insight could help other user struggling with this error. My setup is very basic and I think this the simplest way to access SoftEther from an Android phone. Once the test setup works, more complicated variations can follow. The test setup is to run SoftEther with a fixed IP on a local network (no DDNS) and use the self-signed certificate (cer) issued by SoftEther. The certificate goes into a local folder on the phone to sidestep the complications of loading a certificate into Android. The phone connects to the same local network via wifi, so the vpn is of no practical use, but the authentication issues can be solved. Initially it was a struggle. Three tips: disable name checking, set TLS version to 1.3 (not default) and put the certificate into a folder all by its lonesome self. Why? I am not sure, but I think Open SSTP parses all files in the folder to look for certificates and when an unsupported file type (such as a p12 certificate) is encountered, it gives back the ERR_PARSING_FAILED message without checking the rest of the files. Moving the cer-file to its own folder and pointing Open SSTP to this folder, solved my authentication problems.