# OpenVPN TLS Handshake error **URL:** \ **Category:** Network\ **Created:** [18 October 2024 08:35 UTC](https://community.ipfire.org/t/openvpn-tls-handshake-error/13045 "2024-10-18T08:35:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![shazan81](https://community.ipfire.org/user_avatar/community.ipfire.org/shazan81/32/9905_2.png) [@shazan81](https://community.ipfire.org/u/shazan81)\ **Post date:** [18 October 2024 08:35 UTC](https://community.ipfire.org/t/openvpn-tls-handshake-error/13045/1 "2024-10-18T08:35:30Z")
Hi all, i’m trying to make work an openVPN client version 2.6.12 installed on Windows 11 but i’m getting TLS error. This is the log = 2024-10-18 10:26:57 Note: --data-ciphers-fallback with cipher ‘AES-256-CBC’ disables data channel offload. 2024-10-18 10:26:57 OpenVPN 2.6.12 [git:v2.6.12/038a94bae57a446c] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jul 18 2024 2024-10-18 10:26:57 Windows version 10.0 (Windows 10 or greater), amd64 executable 2024-10-18 10:26:57 library versions: OpenSSL 3.3.1 4 Jun 2024, LZO 2.10 2024-10-18 10:26:57 DCO version: 1.2.1 2024-10-18 10:26:57 MANAGEMENT: TCP Socket listening on [AF\_INET]127.0.0.1:25340 2024-10-18 10:26:57 Need hold release from management interface, waiting… 2024-10-18 10:26:58 MANAGEMENT: Client connected from [AF\_INET]127.0.0.1:26643 2024-10-18 10:26:58 MANAGEMENT: CMD ‘state on’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘log on all’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘echo on all’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘bytecount 5’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘state’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘hold off’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘hold release’ 2024-10-18 10:26:58 MANAGEMENT: CMD ‘password […]’ 2024-10-18 10:26:58 TCP/UDP: Preserving recently used remote address: [AF\_INET]192.168.1.101:1194 2024-10-18 10:26:58 Socket Buffers: R=[65536-\>65536] S=[65536-\>65536] 2024-10-18 10:26:58 UDPv4 link local: (not bound) 2024-10-18 10:26:58 UDPv4 link remote: [AF\_INET]192.168.1.101:1194 2024-10-18 10:26:58 MANAGEMENT: \>STATE:1729240018,WAIT, 2024-10-18 10:27:59 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) 2024-10-18 10:27:59 TLS Error: TLS handshake failed 2024-10-18 10:27:59 SIGUSR1[soft,tls-error] received, process restarting 2024-10-18 10:27:59 MANAGEMENT: \>STATE:1729240079,RECONNECTING,tls-error, 2024-10-18 10:27:59 Restart pause, 1 second(s) 2024-10-18 10:28:00 MANAGEMENT: CMD ‘password […]’ 2024-10-18 10:28:00 TCP/UDP: Preserving recently used remote address: [AF\_INET]192.168.1.101:1194 2024-10-18 10:28:00 Socket Buffers: R=[65536-\>65536] S=[65536-\>65536] 2024-10-18 10:28:00 UDPv4 link local: (not bound) 2024-10-18 10:28:00 UDPv4 link remote: [AF\_INET]192.168.1.101:1194 2024-10-18 10:28:00 MANAGEMENT: \>STATE:1729240080,WAIT, 2024-10-18 10:28:03 SIGTERM[hard,] received, process exiting 2024-10-18 10:28:03 MANAGEMENT: \>STATE:1729240083,EXITING,SIGTERM, I am trying also from another machine with OpenVPN client version 2.5.7 and getting same error. Ipfire 2.27 Core Update 171 ---
**Author:** ![dragonslayr](https://community.ipfire.org/user_avatar/community.ipfire.org/dragonslayr/32/15748_2.png) [@dragonslayr](https://community.ipfire.org/u/dragonslayr)\ **Post date:** [20 October 2024 10:31 UTC](https://community.ipfire.org/t/openvpn-tls-handshake-error/13045/2 "2024-10-20T10:31:42Z")
check your logs in ipfire. cat /var/log/messages | grep openvpnserver Look for a line that says error=CRL has expired BTW, you might consider changing (on ipfire) to AES-GCM 256 bit as your going to have to at some point anyway. ---
**Author:** ![shazan81](https://community.ipfire.org/user_avatar/community.ipfire.org/shazan81/32/9905_2.png) [@shazan81](https://community.ipfire.org/u/shazan81)\ **Post date:** [22 October 2024 07:03 UTC](https://community.ipfire.org/t/openvpn-tls-handshake-error/13045/3 "2024-10-22T07:03:04Z")
Thanks for the reply. Checking logs the unique line with CRL is this : “CRL: loaded 1 CRLs from file /var/ipfire/ovpn/crls/cacrl.pem” For encryption type ia have already change to AES-GCM 256 bit but the problem persist ---
**Author:** ![dragonslayr](https://community.ipfire.org/user_avatar/community.ipfire.org/dragonslayr/32/15748_2.png) [@dragonslayr](https://community.ipfire.org/u/dragonslayr)\ **Post date:** [22 October 2024 22:38 UTC](https://community.ipfire.org/t/openvpn-tls-handshake-error/13045/4 "2024-10-22T22:38:48Z")
I’m no guru on OpenVPN, but it looks like your connecting to ```auto UDPv4 link remote: [AF_INET]192.168.1.101:1194 ``` I expect to see an internet address there. Are you trying to connect from “inside” the green network? Also, might suggest you change the subnet on your green network. 192.168.1.0/24 is way to common, and can not be the same as the subnet you are connecting from. Definitely change this on the ipfire server.