TLS Handshake Timeout

ibzx

The following configuration was working a few days ago and now no longer works. Running the VPN Client from the same HOST as the server results in the same TLS Handshake timeout. TCP Connection is established and LDAP authentication happens but no TLS handshake.

Client Config
sudo openvpn --dev tun2 --remote vpn.example.com --auth-user-pass --pull --client --ca ROOT.crt --proto tcp --verb 5 --script-security 3 --tls-client --comp-lzo

server.conf

local 0.0.0.0
port 1194
proto tcp
dev tun
client-cert-not-required
tls-server
ca /etc/openvpn/ssl/certs/ROOT.pem
cert /etc/openvpn/ssl/certs/server.crt
key /etc/openvpn/ssl/certs/server.key
dh /etc/openvpn/ssl/dh2048.pem
server 10.1.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "route 10.0.0.0 255.255.0.0"

push "dhcp-option dns 10.0.1.10"

keepalive 10 120

comp-lzo

persist-key
persist-tun

#daemon
#topology subnet

log-append  /var/log/openvpn.log
verb 5
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/server/ldap.conf

#user nobody
#group nobody

Server log

Tue May 22 21:08:53 2012 us=161742 MULTI: multi_create_instance called
Tue May 22 21:08:53 2012 us=161851 Re-using SSL/TLS context
Tue May 22 21:08:53 2012 us=161942 LZO compression initialized
Tue May 22 21:08:53 2012 us=162061 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue May 22 21:08:53 2012 us=162162 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 22 21:08:53 2012 us=162274 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May 22 21:08:53 2012 us=162364 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May 22 21:08:53 2012 us=162458 Local Options hash (VER=V4): 'c0103fa8'
Tue May 22 21:08:53 2012 us=162548 Expected Remote Options hash (VER=V4): '69109d17'
Tue May 22 21:08:53 2012 us=162651 TCP connection established with [AF_INET]69.12.244.18:53869
Tue May 22 21:08:53 2012 us=162743 TCPv4_SERVER link local: [undef]
Tue May 22 21:08:53 2012 us=162830 TCPv4_SERVER link remote: [AF_INET]69.12.244.18:53869
Tue May 22 21:08:53 2012 us=162967 69.12.244.18:53869 MULTI: multi_create_instance called
Tue May 22 21:08:53 2012 us=163072 69.12.244.18:53869 Re-using SSL/TLS context
Tue May 22 21:08:53 2012 us=163163 69.12.244.18:53869 LZO compression initialized
Tue May 22 21:08:53 2012 us=163281 69.12.244.18:53869 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue May 22 21:08:53 2012 us=163379 69.12.244.18:53869 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 22 21:08:53 2012 us=163481 69.12.244.18:53869 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May 22 21:08:53 2012 us=163571 69.12.244.18:53869 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May 22 21:08:53 2012 us=163664 69.12.244.18:53869 Local Options hash (VER=V4): 'c0103fa8'
Tue May 22 21:08:53 2012 us=163754 69.12.244.18:53869 Expected Remote Options hash (VER=V4): '69109d17'
Tue May 22 21:08:53 2012 us=163848 69.12.244.18:53869 TCP connection established with [AF_INET]69.12.244.18:47838
Tue May 22 21:08:53 2012 us=163938 69.12.244.18:53869 TCPv4_SERVER link local: [undef]
Tue May 22 21:08:53 2012 us=164026 69.12.244.18:53869 TCPv4_SERVER link remote: [AF_INET]69.12.244.18:47838
RTue May 22 21:08:53 2012 us=164239 69.12.244.18:53869 TLS: Initial packet from [AF_INET]69.12.244.18:53869, sid=44e9ac89 d56c0b50
WRWRWRWRWRTue May 22 21:08:53 2012 us=165210 69.12.244.18:47838 TLS: Initial packet from [AF_INET]69.12.244.18:47838, sid=3669671a 5e704af8

client log

Tue May 22 14:07:20 2012 us=560764 Restart pause, 5 second(s)
Tue May 22 14:07:25 2012 us=560883 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue May 22 14:07:25 2012 us=560962 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue May 22 14:07:25 2012 us=561779 LZO compression initialized
Tue May 22 14:07:25 2012 us=561896 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue May 22 14:07:25 2012 us=561956 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue May 22 14:07:25 2012 us=563085 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 22 14:07:25 2012 us=563151 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May 22 14:07:25 2012 us=563174 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May 22 14:07:25 2012 us=563213 Local Options hash (VER=V4): '69109d17'
Tue May 22 14:07:25 2012 us=563244 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue May 22 14:07:25 2012 us=563275 Attempting to establish TCP connection with [AF_INET]SERVER:1194 [nonblock]
Tue May 22 14:07:26 2012 us=563465 TCP connection established with [AF_INET]SERVER:1194
Tue May 22 14:07:26 2012 us=563565 TCPv4_CLIENT link local: [undef]
Tue May 22 14:07:26 2012 us=563608 TCPv4_CLIENT link remote: [AF_INET]SERVER:1194
WWWRTue May 22 14:07:37 2012 us=694532 TLS: Initial packet from [AF_INET]SERVER:1194, sid=0e52bbdb 544db82b
WWWWRRRRRRRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRTue May 22 14:07:39 2012 us=507154 VERIFY OK: depth=2, /O=XXXXXXX/CN=SM-CAROOT
Tue May 22 14:07:39 2012 us=508234 VERIFY OK: depth=1, /CN=XXXXXXXXXXXX
Tue May 22 14:07:39 2012 us=509444 VERIFY OK: depth=0, /CN=vpn.example.com/CN=XXXXXX
WWRWRWRRWWRWRWRWWWWRRRRRRWWWWWRRRWWWWTue May 22 14:08:26 2012 us=8494 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue May 22 14:08:26 2012 us=8575 TLS Error: TLS handshake failed
Tue May 22 14:08:26 2012 us=8947 Fatal TLS error (check_tls_errors_co), restarting
Tue May 22 14:08:26 2012 us=9050 TCP/UDP: Closing socket
Tue May 22 14:08:26 2012 us=9147 SIGUSR1[soft,tls-error] received, process restarting
Tue May 22 14:08:26 2012 us=9193 Restart pause, 5 second(s)

Mimiko

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

From client I don't see any LDAP trying to authenticate.
Remove from client "--ca ROOT.crt".
In the server.conf, the line

ca /etc/openvpn/ssl/certs/ROOT.pem

is correct? Does the ROOT.pem has correct data? It must be with extension .crt.

johnlth93

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

this error probably caused by error in establishing connection between client to server
could be firewall in between that blocked the connection

Mimiko

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

When such messages occures, its definately that OpenVPN server is not accesible on the IP and PORT and Protocol your setup is. When certificates are bad, there will be over types of messages. Check everything: firewall, route, routers that may filter packets for VPN.