Openvpn – Tunnelblick Options error: Unrecognized option or missing parameter(s) in tls-crypt (2.3.17)

mac-osxopenvpn

I have a new OpenVPN config which runs Ok on the server but the client fails to connect with the following error:

Options error: Unrecognized option or missing parameter(s) in /Library/Application Support/Tunnelblick/Users/Mark/markhorrocks.tblk/Contents/Resources/config.ovpn:28: tls-crypt (2.3.17)

Tunnelblick Log:

*Tunnelblick: OS X 10.12.5; Tunnelblick 3.7.2beta03 (build 4840); prior version 3.7.2beta02 (build 4830) 2017-07-06 23:54:08
*Tunnelblick: Attempting connection with markhorrocks using shadow copy; Set nameserver = 771; monitoring connection 2017-07-06 23:54:08
*Tunnelblick: openvpnstart start markhorrocks.tblk 1337 771 0 1 0 1065264 -ptADGNWradsgnw 2.3.17-openssl-1.0.2k 2017-07-06 23:54:08
*Tunnelblick:

Could not start OpenVPN (openvpnstart returned with status #251)

Contents of the openvpnstart log:
*Tunnelblick: openvpnstart log:
Warning: Tunnelblick is using 'openvpn-down-root.so', so the route-pre-down script will not be used. You can override this by
providing a custom route-pre-down script (which may be a copy of
Tunnelblick's standard route-pre-down script) in a Tunnelblick VPN
Configuration. However, that script will not be executed as root
unless the 'user' and 'group' options are removed from the OpenVPN
configuration file. If the 'user' and 'group' options are removed,
then you don't need to use a custom route-pre-down script.OpenVPN
returned with status 1, errno = 0:
Undefined error: 0

 Command used to start OpenVPN (one argument per displayed line):

      /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.17-openssl-1.0.2k/openvpn
      --daemon
      --log
      /Library/Application Support/Tunnelblick/Logs/-SUsers-SMark-SLibrary-SApplication

Support-STunnelblick-SConfigurations-Smarkhorrocks.tblk-SContents-SResources-Sconfig.ovpn.771_0_1_0_1065264.1337.openvpn.log
–cd
/Library/Application Support/Tunnelblick/Users/Mark/markhorrocks.tblk/Contents/Resources
–verb
3
–config
/Library/Application Support/Tunnelblick/Users/Mark/markhorrocks.tblk/Contents/Resources/config.ovpn
–verb
3
–cd
/Library/Application Support/Tunnelblick/Users/Mark/markhorrocks.tblk/Contents/Resources
–management
127.0.0.1
1337
–management-query-passwords
–management-hold
–script-security
2
–up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh
-9 -d -f -m -w -ptADGNWradsgnw
–plugin
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.17-openssl-1.0.2k/openvpn-down-root.so
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh
-9 -d -f -m -w -ptADGNWradsgnw

 Contents of the OpenVPN log:

      Options error: Unrecognized option or missing parameter(s) in /Library/Application

Support/Tunnelblick/Users/Mark/markhorrocks.tblk/Contents/Resources/config.ovpn:28:
tls-crypt (2.3.17)
Use –help for more information.

 More details may be in the Console Log's "All Messages"

================================================================================

"Sanitized" full configuration file

client
proto udp
dev tun
remote vpn.mydomain.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-GCM
tls-version-min 1.2
tls-client
ping 15
ping-restart 120
route 10.0.0.0 255.0.0.0
route-nopull

daemon

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup

<ca>
 [Security-related line(s) omitted]
</ca>
<cert>
 [Security-related line(s) omitted]
</cert>
<key>
 [Security-related line(s) omitted]
</key>
<tls-crypt>
 [Security-related line(s) omitted]
</tls-crypt>

Best Answer

OpenVPN added tls-crypt functionality in version 2.4+. Tunnelblick defaults to using OpenVPN 2.3.7 in the settings for some reason, even in the latest releases (from what I have experienced). So just update the 'OpenVPN' version in the 'Settings' menu of Tunnelblick to 2.4+ and you should be good to go!