OpenVPN TLS Handshake error

Networking
1

Hi all,
i’m trying to make work an openVPN client version 2.6.12 installed on Windows 11 but i’m getting TLS error.
This is the log =

2024-10-18 10:26:57 Note: --data-ciphers-fallback with cipher ‘AES-256-CBC’ disables data channel offload.
2024-10-18 10:26:57 OpenVPN 2.6.12 [git:v2.6.12/038a94bae57a446c] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jul 18 2024
2024-10-18 10:26:57 Windows version 10.0 (Windows 10 or greater), amd64 executable
2024-10-18 10:26:57 library versions: OpenSSL 3.3.1 4 Jun 2024, LZO 2.10
2024-10-18 10:26:57 DCO version: 1.2.1
2024-10-18 10:26:57 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2024-10-18 10:26:57 Need hold release from management interface, waiting…
2024-10-18 10:26:58 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:26643
2024-10-18 10:26:58 MANAGEMENT: CMD ‘state on’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘log on all’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘echo on all’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘bytecount 5’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘state’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘hold off’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘hold release’
2024-10-18 10:26:58 MANAGEMENT: CMD ‘password […]’
2024-10-18 10:26:58 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.1.101:1194
2024-10-18 10:26:58 Socket Buffers: R=[65536->65536] S=[65536->65536]
2024-10-18 10:26:58 UDPv4 link local: (not bound)
2024-10-18 10:26:58 UDPv4 link remote: [AF_INET]192.168.1.101:1194
2024-10-18 10:26:58 MANAGEMENT: >STATE:1729240018,WAIT,
2024-10-18 10:27:59 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2024-10-18 10:27:59 TLS Error: TLS handshake failed
2024-10-18 10:27:59 SIGUSR1[soft,tls-error] received, process restarting
2024-10-18 10:27:59 MANAGEMENT: >STATE:1729240079,RECONNECTING,tls-error,
2024-10-18 10:27:59 Restart pause, 1 second(s)
2024-10-18 10:28:00 MANAGEMENT: CMD ‘password […]’
2024-10-18 10:28:00 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.1.101:1194
2024-10-18 10:28:00 Socket Buffers: R=[65536->65536] S=[65536->65536]
2024-10-18 10:28:00 UDPv4 link local: (not bound)
2024-10-18 10:28:00 UDPv4 link remote: [AF_INET]192.168.1.101:1194
2024-10-18 10:28:00 MANAGEMENT: >STATE:1729240080,WAIT,
2024-10-18 10:28:03 SIGTERM[hard,] received, process exiting
2024-10-18 10:28:03 MANAGEMENT: >STATE:1729240083,EXITING,SIGTERM,

I am trying also from another machine with OpenVPN client version 2.5.7 and getting same error.

Ipfire 2.27 Core Update 171

2

check your logs in ipfire.
cat /var/log/messages | grep openvpnserver

Look for a line that says error=CRL has expired

BTW, you might consider changing (on ipfire) to AES-GCM 256 bit as your going to have to at some point anyway.

3

Thanks for the reply.
Checking logs the unique line with CRL is this :
“CRL: loaded 1 CRLs from file /var/ipfire/ovpn/crls/cacrl.pem”

For encryption type ia have already change to AES-GCM 256 bit but the problem persist

4

I’m no guru on OpenVPN, but it looks like your connecting to

UDPv4 link remote: [AF_INET]192.168.1.101:1194

I expect to see an internet address there. Are you trying to connect from “inside” the green network?

Also, might suggest you change the subnet on your green network. 192.168.1.0/24 is way to common, and can not be the same as the subnet you are connecting from. Definitely change this on the ipfire server.