TLS Error: TLS handshake failed

dkorzhevin

Hi,

Please advice with problem:

User use tunelblick 3.3beta36 connecting to openvpn server 2.1.3-2+squeeze1 on Debian 6.0.7 amd64.

User log from tunelblick:

2013-03-30 13:08:33 *Tunnelblick: OS X 10.7.5; Tunnelblick 3.3beta34 (build 3219)
2013-03-30 13:08:33 *Tunnelblick: Attempting connection with vpnshield-443; Set nameserver = 1; monitoring connection
2013-03-30 13:08:33 *Tunnelblick: openvpnstart start vpnshield-443.tblk 1337 1 0 3 0 305 -atADGNWradsgnw
2013-03-30 13:08:33 *Tunnelblick: openvpnstart log:
     Loading tun.kext
    
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
    
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn
          --cd
          /Library/Application Support/Tunnelblick/Shared/vpnshield-443.tblk/Contents/Resources
          --daemon
          --management
          127.0.0.1
          1337
          --config
          /Library/Application Support/Tunnelblick/Shared/vpnshield-443.tblk/Contents/Resources/config.ovpn
          --log
          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Svpnshield--443.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_305.1337.openvpn.log
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -atADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -atADGNWradsgnw
          --up-restart

2013-03-30 13:08:33 *Tunnelblick: Established communication with OpenVPN
2013-03-30 13:08:33 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Feb 14 2013
2013-03-30 13:08:33 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2013-03-30 13:08:33 Need hold release from management interface, waiting...
2013-03-30 13:08:33 MANAGEMENT: Client connected from 127.0.0.1:1337
2013-03-30 13:08:33 MANAGEMENT: CMD 'pid'
2013-03-30 13:08:33 MANAGEMENT: CMD 'state on'
2013-03-30 13:08:33 MANAGEMENT: CMD 'state'
2013-03-30 13:08:33 MANAGEMENT: CMD 'bytecount 1'
2013-03-30 13:08:33 MANAGEMENT: CMD 'hold release'
2013-03-30 13:08:33 *Tunnelblick: openvpnstart starting OpenVPN:
                    *                    /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --cd /Library/Application Support/Tunnelblick/Shared/vpnshield-443.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Shared/vpnshield-443.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Svpnshield--443.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_305.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -atADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -atADGNWradsgnw --up-restart
2013-03-30 13:08:34 *Tunnelblick: Obtained VPN username and password from the Keychain
2013-03-30 13:08:34 MANAGEMENT: CMD 'username "Auth" "PASSWORD"'
2013-03-30 13:08:34 MANAGEMENT: CMD 'password [...]'
2013-03-30 13:08:34 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-03-30 13:08:34 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
2013-03-30 13:08:34 Socket Buffers: R=[262140->65536] S=[131070->65536]
2013-03-30 13:08:34 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
2013-03-30 13:08:34 Local Options hash (VER=V4): 'db02a8f8'
2013-03-30 13:08:34 Expected Remote Options hash (VER=V4): '7e068940'
2013-03-30 13:08:34 Attempting to establish TCP connection with SERVER_IP:443 [nonblock]
2013-03-30 13:08:34 MANAGEMENT: >STATE:1364632714,TCP_CONNECT,,,
2013-03-30 13:08:35 TCP connection established with SERVER_IP:443
2013-03-30 13:08:35 TCPv4_CLIENT link local: [undef]
2013-03-30 13:08:35 TCPv4_CLIENT link remote: SERVER_IP:443
2013-03-30 13:08:35 MANAGEMENT: >STATE:1364632715,WAIT,,,
2013-03-30 13:08:35 MANAGEMENT: >STATE:1364632715,AUTH,,,
2013-03-30 13:08:35 TLS: Initial packet from SERVER_IP:443, sid=c61a090f b5e87fed
2013-03-30 13:09:34 Connection reset, restarting [0]
2013-03-30 13:09:34 TCP/UDP: Closing socket
2013-03-30 13:09:34 SIGUSR1[soft,connection-reset] received, process restarting
2013-03-30 13:09:34 MANAGEMENT: >STATE:1364632774,RECONNECTING,connection-reset,,
2013-03-30 13:09:34 MANAGEMENT: CMD 'hold release'
2013-03-30 13:09:34 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-03-30 13:09:34 Re-using SSL/TLS context
2013-03-30 13:09:34 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
2013-03-30 13:09:34 Socket Buffers: R=[262140->65536] S=[131070->65536]
2013-03-30 13:09:34 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
2013-03-30 13:09:34 Local Options hash (VER=V4): 'db02a8f8'
2013-03-30 13:09:34 Expected Remote Options hash (VER=V4): '7e068940'
2013-03-30 13:09:34 Attempting to establish TCP connection with SERVER_IP:443 [nonblock]
2013-03-30 13:09:34 MANAGEMENT: >STATE:1364632774,TCP_CONNECT,,,
2013-03-30 13:09:35 TCP connection established with SERVER_IP:443
2013-03-30 13:09:35 TCPv4_CLIENT link local: [undef]
2013-03-30 13:09:35 TCPv4_CLIENT link remote: SERVER_IP:443
2013-03-30 13:09:35 MANAGEMENT: >STATE:1364632775,WAIT,,,
2013-03-30 13:09:36 MANAGEMENT: >STATE:1364632776,AUTH,,,
2013-03-30 13:09:36 TLS: Initial packet from SERVER_IP:443, sid=1c8a4391 4029a09a
2013-03-30 13:09:36 *Tunnelblick: Obtained VPN username and password from the Keychain
2013-03-30 13:09:36 MANAGEMENT: CMD 'username "Auth" "PASSWORD"'
2013-03-30 13:09:36 MANAGEMENT: CMD 'password [...]'
2013-03-30 13:10:35 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2013-03-30 13:10:35 TLS Error: TLS handshake failed
2013-03-30 13:10:35 Fatal TLS error (check_tls_errors_co), restarting
2013-03-30 13:10:35 TCP/UDP: Closing socket
2013-03-30 13:10:35 SIGUSR1[soft,tls-error] received, process restarting
2013-03-30 13:10:35 MANAGEMENT: >STATE:1364632835,RECONNECTING,tls-error,,
2013-03-30 13:10:35 MANAGEMENT: CMD 'hold release'
2013-03-30 13:10:35 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-03-30 13:10:35 Re-using SSL/TLS context
2013-03-30 13:10:35 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
2013-03-30 13:10:35 Socket Buffers: R=[262140->65536] S=[131070->65536]
2013-03-30 13:10:35 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
2013-03-30 13:10:35 Local Options hash (VER=V4): 'db02a8f8'
2013-03-30 13:10:35 Expected Remote Options hash (VER=V4): '7e068940'
2013-03-30 13:10:35 Attempting to establish TCP connection with SERVER_IP:443 [nonblock]
2013-03-30 13:10:35 MANAGEMENT: >STATE:1364632835,TCP_CONNECT,,,
2013-03-30 13:10:36 TCP connection established with SERVER_IP:443
2013-03-30 13:10:36 TCPv4_CLIENT link local: [undef]
2013-03-30 13:10:36 TCPv4_CLIENT link remote: SERVER_IP:443
2013-03-30 13:10:36 MANAGEMENT: >STATE:1364632836,WAIT,,,
2013-03-30 13:10:36 *Tunnelblick: Obtained VPN username and password from the Keychain
2013-03-30 13:10:36 MANAGEMENT: >STATE:1364632836,AUTH,,,
2013-03-30 13:10:36 TLS: Initial packet from SERVER_IP:443, sid=8eb16a3f 3a26d705
2013-03-30 13:10:36 MANAGEMENT: CMD 'username "Auth" "PASSWORD"'
2013-03-30 13:10:36 MANAGEMENT: CMD 'password [...]'

Server side config:

#plugin /etc/openvpn/radiusplugin.so

dev tun
## udp is recommended, avoid TCP over TCP
proto tcp
## any port will do, this is the standard
port 443

tun-mtu 1500
tun-mtu-extra 32
mssfix 1450

## certs we created earlier
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

user nobody
group nogroup
## You can make this any private subnet you like
server 10.4.0.0 255.255.0.0

persist-key
persist-tun

#status openvpn-status.log
#verb 3
client-to-client

## make this connection the default gateway for network traffic
push "redirect-gateway def1"
## I am running dns_masq, you may want to put your server's DNS here
## or even google: 8.8.8.8
push "dhcp-option DNS 8.8.8.8"

log-append /var/log/openvpn

## User authentication settings. Usernames must be able to authenticate with PAM
## To use radius or another auth mechanism create /etc/pam.d/openvpn
## by default it is doing common-auth (a user must have a local accout and pasword)
#plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name

keepalive 5 30

## A management interface allows you to telnet from local host to use
## telnet localhost 7505
management localhost 7506

status /var/log/openvpn-status.log

log-append /var/log/openvpn-status.log


verb 3

##plugin /usr/lib/openvpn/openvpn-auth-pam.so "login login USERNAME password PASSWORD"
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin-tcp443.cnf

Client's config:

##############################################
# Sample client-side OpenVPN 2.0 config file.
# for connecting to multi-client server.
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

dev tun
proto tcp

# The hostname/IP and port of the server.
remote SERVER_IP 443


# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# Certificate Authority
#ca ca.crt

ca [inline]

# Username/Password authentication is used on the server
auth-user-pass

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# Set log file verbosity.
verb 3
auth-nocache

<ca>
-----BEGIN CERTIFICATE-----

CERTIFICATE

-----END CERTIFICATE-----
</ca>

maikcat

server logs?

please remove comments from your configs

Michael.