Can't connect to AS

dennish

When we try to connect to the server we are seeing the following in the server logs:

TLS_ERROR: BIO read tls_read_plaintext error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol'

I have the server set for TLS 1.1

The Johan

This problem can occur if the client was installed when the server was set to TLS 1.0 or default before you made the change to TLS 1.1/1.2. Try a reinstall now of the Connect Client on this system that is having this problem.

dennish

I uninstalled and re-installed the connect client. Same issue. Client shows a connect timeout message and the server shows the above in the logs.

The Johan

It's possible you have an older version of Access Server and Connect Client that had issues with TLS 1.1 and TLS 1.2. When we implemented TLS 1.1/1.2 on OpenVPN Access Server, at the time, not all OpenVPN clients were actually able to connect to servers with that specification. Even now we sometimes encounter older OpenVPN client software that is not able to make a connection. I'm convinced that once you update your software, it will work. Out of curiosity, what version of Access Server do you have now?

dennish

I changed back to TLS 1.0 and it connected. Haven't tried 1.2.

dennish

Using the AS appliance 2.0.12.

The Johan

I can now confirm with absolutely certainty that the Connect Client bundled in that version will not connect to a TLS 1.1/TLS 1.2 version server. Kindly update your Access Server and download and install the new Connect Client and it will then function.

If you encounter further issues please contact the support ticket system by going to http://www.openvpn.net, signing in there with the account for openvpn.net, going to the 'support' link at the top of the page, and then open a support ticket in the Access Server support department there, and explain your issue. They will be able to help you further there to get things working, and they can also provide you with details update instructions.

dennish

Thanks, opened up a ticket. I ran updates on the server but apparently it didn't update some stuff.

The Johan

There's a difference between running apt-get update and apt-get upgrade, and updating the Access Server package.