I've got a OpenVPN server with certificate auth and need to have a new session-key every hour. (For tests, I set reneg-sec to 40).
Every time the reneg-sec expires, I get a data transmission delay of about 6-7 seconds. This is too much in my application.
If I set tran-window to 0, I get lost packets for about 8 seconds. That means, tran-window is working, but not like I expect.
In my opinion, the key negotiation should work in parallel while data transmission is neither lost nor delayed.
Ok, things that lead to those 6-7s in my setup were a CPU with only 400MHz at a single core and the requirement to use diffie hellman with 3072bits.
Using diffie hellman with 1024 bits reduces the delay to about 1s. Using another computer with a more powerful CPU reduces the delay, too.
I've tested a lot until now. Several different computers, several different servers and checked the data transmission via wireshark. The data transmission is not delayed while client and server are sending their certificates to each other. It starts after this is done.
But why is the data transmission delayed while the new key is getting computed?
best regards
Thailf
Tue Mar 21 11:28:05 2017 us=288507 Current Parameter Settings:
Tue Mar 21 11:28:05 2017 us=289826 config = '/usr/etc/openvpn/client.ovpn'
Tue Mar 21 11:28:05 2017 us=290165 mode = 0
Tue Mar 21 11:28:05 2017 us=290478 persist_config = DISABLED
Tue Mar 21 11:28:05 2017 us=290783 persist_mode = 1
Tue Mar 21 11:28:05 2017 us=291087 show_ciphers = DISABLED
Tue Mar 21 11:28:05 2017 us=291392 show_digests = DISABLED
Tue Mar 21 11:28:05 2017 us=291693 show_engines = DISABLED
Tue Mar 21 11:28:05 2017 us=291994 genkey = DISABLED
Tue Mar 21 11:28:05 2017 us=292291 key_pass_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=292594 show_tls_ciphers = DISABLED
Tue Mar 21 11:28:05 2017 us=292894 Connection profiles [default]:
Tue Mar 21 11:28:05 2017 us=293250 proto = udp
Tue Mar 21 11:28:05 2017 us=293660 local = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=293987 local_port = 0
Tue Mar 21 11:28:05 2017 us=294298 remote = '192.168.21.17'
Tue Mar 21 11:28:05 2017 us=294605 remote_port = 1194
Tue Mar 21 11:28:05 2017 us=294913 remote_float = DISABLED
Tue Mar 21 11:28:05 2017 us=295217 bind_defined = DISABLED
Tue Mar 21 11:28:05 2017 us=295520 bind_local = DISABLED
Tue Mar 21 11:28:05 2017 us=295825 connect_retry_seconds = 5
Tue Mar 21 11:28:05 2017 us=296134 connect_timeout = 10
Tue Mar 21 11:28:05 2017 us=296437 connect_retry_max = 0
Tue Mar 21 11:28:05 2017 us=296742 socks_proxy_server = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=297054 socks_proxy_port = 0
Tue Mar 21 11:28:05 2017 us=297357 socks_proxy_retry = DISABLED
Tue Mar 21 11:28:05 2017 us=297661 tun_mtu = 1500
Tue Mar 21 11:28:05 2017 us=297962 tun_mtu_defined = ENABLED
Tue Mar 21 11:28:05 2017 us=298266 link_mtu = 1500
Tue Mar 21 11:28:05 2017 us=298568 link_mtu_defined = DISABLED
Tue Mar 21 11:28:05 2017 us=298872 tun_mtu_extra = 0
Tue Mar 21 11:28:05 2017 us=299179 tun_mtu_extra_defined = DISABLED
Tue Mar 21 11:28:05 2017 us=299485 mtu_discover_type = -1
Tue Mar 21 11:28:05 2017 us=299790 fragment = 1300
Tue Mar 21 11:28:05 2017 us=300092 mssfix = 1450
Tue Mar 21 11:28:05 2017 us=300395 explicit_exit_notification = 0
Tue Mar 21 11:28:05 2017 us=301312 Connection profiles END
Tue Mar 21 11:28:05 2017 us=301643 remote_random = DISABLED
Tue Mar 21 11:28:05 2017 us=301949 ipchange = '/usr/etc/openvpn/ipchange.sh'
Tue Mar 21 11:28:05 2017 us=302251 dev = 'tun2'
Tue Mar 21 11:28:05 2017 us=302550 dev_type = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=302848 dev_node = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=303149 lladdr = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=303449 topology = 1
Tue Mar 21 11:28:05 2017 us=303955 tun_ipv6 = DISABLED
Tue Mar 21 11:28:05 2017 us=304322 ifconfig_local = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=304636 ifconfig_remote_netmask = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=304942 ifconfig_noexec = DISABLED
Tue Mar 21 11:28:05 2017 us=305245 ifconfig_nowarn = DISABLED
Tue Mar 21 11:28:05 2017 us=305544 ifconfig_ipv6_local = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=305852 ifconfig_ipv6_netbits = 0
Tue Mar 21 11:28:05 2017 us=306153 ifconfig_ipv6_remote = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=306454 shaper = 0
Tue Mar 21 11:28:05 2017 us=306755 mtu_test = 0
Tue Mar 21 11:28:05 2017 us=307047 mlock = DISABLED
Tue Mar 21 11:28:05 2017 us=307346 keepalive_ping = 0
Tue Mar 21 11:28:05 2017 us=307650 keepalive_timeout = 0
Tue Mar 21 11:28:05 2017 us=307953 inactivity_timeout = 0
Tue Mar 21 11:28:05 2017 us=308256 ping_send_timeout = 0
Tue Mar 21 11:28:05 2017 us=308550 ping_rec_timeout = 0
Tue Mar 21 11:28:05 2017 us=308853 ping_rec_timeout_action = 0
Tue Mar 21 11:28:05 2017 us=309150 ping_timer_remote = ENABLED
Tue Mar 21 11:28:05 2017 us=309638 remap_sigusr1 = 0
Tue Mar 21 11:28:05 2017 us=309956 persist_tun = DISABLED
Tue Mar 21 11:28:05 2017 us=310262 persist_local_ip = DISABLED
Tue Mar 21 11:28:05 2017 us=310564 persist_remote_ip = DISABLED
Tue Mar 21 11:28:05 2017 us=311327 persist_key = ENABLED
Tue Mar 21 11:28:05 2017 us=311668 passtos = DISABLED
Tue Mar 21 11:28:05 2017 us=311989 resolve_retry_seconds = 1000000000
Tue Mar 21 11:28:05 2017 us=312294 username = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=312595 groupname = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=312890 chroot_dir = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=313190 cd_dir = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=313490 writepid = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=313790 up_script = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=314088 down_script = '/usr/etc/openvpn/down.sh'
Tue Mar 21 11:28:05 2017 us=314387 down_pre = DISABLED
Tue Mar 21 11:28:05 2017 us=314689 up_restart = DISABLED
Tue Mar 21 11:28:05 2017 us=314989 up_delay = DISABLED
Tue Mar 21 11:28:05 2017 us=315291 daemon = DISABLED
Tue Mar 21 11:28:05 2017 us=315590 inetd = 0
Tue Mar 21 11:28:05 2017 us=315890 log = ENABLED
Tue Mar 21 11:28:05 2017 us=316191 suppress_timestamps = DISABLED
Tue Mar 21 11:28:05 2017 us=316493 nice = 0
Tue Mar 21 11:28:05 2017 us=316792 verbosity = 4
Tue Mar 21 11:28:05 2017 us=317091 mute = 0
Tue Mar 21 11:28:05 2017 us=317497 gremlin = 0
Tue Mar 21 11:28:05 2017 us=317801 status_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=318110 status_file_version = 1
Tue Mar 21 11:28:05 2017 us=318443 status_file_update_freq = 60
Tue Mar 21 11:28:05 2017 us=318744 occ = ENABLED
Tue Mar 21 11:28:05 2017 us=319324 rcvbuf = 65536
Tue Mar 21 11:28:05 2017 us=319673 sndbuf = 65536
Tue Mar 21 11:28:05 2017 us=319995 mark = 0
Tue Mar 21 11:28:05 2017 us=320304 sockflags = 0
Tue Mar 21 11:28:05 2017 us=320607 fast_io = DISABLED
Tue Mar 21 11:28:05 2017 us=320906 lzo = 7
Tue Mar 21 11:28:05 2017 us=321208 route_script = '/usr/etc/openvpn/route-up.sh'
Tue Mar 21 11:28:05 2017 us=321512 route_default_gateway = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=321815 route_default_metric = 0
Tue Mar 21 11:28:05 2017 us=322119 route_noexec = DISABLED
Tue Mar 21 11:28:05 2017 us=322426 route_delay = 0
Tue Mar 21 11:28:05 2017 us=322738 route_delay_window = 30
Tue Mar 21 11:28:05 2017 us=323046 route_delay_defined = DISABLED
Tue Mar 21 11:28:05 2017 us=323353 route_nopull = DISABLED
Tue Mar 21 11:28:05 2017 us=323731 route_gateway_via_dhcp = DISABLED
Tue Mar 21 11:28:05 2017 us=324049 max_routes = 100
Tue Mar 21 11:28:05 2017 us=324357 allow_pull_fqdn = DISABLED
Tue Mar 21 11:28:05 2017 us=324668 management_addr = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=325084 management_port = 0
Tue Mar 21 11:28:05 2017 us=325409 management_user_pass = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=325726 management_log_history_cache = 250
Tue Mar 21 11:28:05 2017 us=326041 management_echo_buffer_size = 100
Tue Mar 21 11:28:05 2017 us=326348 management_write_peer_info_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=326715 management_client_user = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=327047 management_client_group = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=327363 management_flags = 0
Tue Mar 21 11:28:05 2017 us=327672 shared_secret_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=327981 key_direction = 2
Tue Mar 21 11:28:05 2017 us=328283 ciphername_defined = ENABLED
Tue Mar 21 11:28:05 2017 us=329264 ciphername = 'AES-256-CBC'
Tue Mar 21 11:28:05 2017 us=329621 authname_defined = ENABLED
Tue Mar 21 11:28:05 2017 us=329938 authname = 'SHA512'
Tue Mar 21 11:28:05 2017 us=330248 prng_hash = 'SHA1'
Tue Mar 21 11:28:05 2017 us=330560 prng_nonce_secret_len = 16
Tue Mar 21 11:28:05 2017 us=330870 keysize = 0
Tue Mar 21 11:28:05 2017 us=331174 replay = ENABLED
Tue Mar 21 11:28:05 2017 us=331479 mute_replay_warnings = ENABLED
Tue Mar 21 11:28:05 2017 us=331789 replay_window = 64
Tue Mar 21 11:28:05 2017 us=332098 replay_time = 15
Tue Mar 21 11:28:05 2017 us=332402 packet_id_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=332818 use_iv = ENABLED
Tue Mar 21 11:28:05 2017 us=333137 test_crypto = DISABLED
Tue Mar 21 11:28:05 2017 us=333796 use_prediction_resistance = DISABLED
Tue Mar 21 11:28:05 2017 us=334137 tls_server = DISABLED
Tue Mar 21 11:28:05 2017 us=334455 tls_client = ENABLED
Tue Mar 21 11:28:05 2017 us=334771 key_method = 2
Tue Mar 21 11:28:05 2017 us=335080 ca_file = '/mnt/certstore/CA.pem'
Tue Mar 21 11:28:05 2017 us=335736 ca_path = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=336078 dh_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=336397 cert_file = '/mnt/certstore/client.pem'
Tue Mar 21 11:28:05 2017 us=336713 priv_key_file = '/mnt/certstore/client.key.pem'
Tue Mar 21 11:28:05 2017 us=337315 cipher_list = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=337914 tls_verify = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=338270 tls_export_cert = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=338591 verify_x509_type = 0
Tue Mar 21 11:28:05 2017 us=339214 verify_x509_name = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=339593 crl_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=339919 ns_cert_type = 0
Tue Mar 21 11:28:05 2017 us=340321 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=340648 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=340966 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=341275 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=341586 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=341897 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=342204 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=342515 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=342824 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=343128 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=343435 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=343747 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=344057 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=344368 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=344677 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=344986 remote_cert_ku[i] = 0
Tue Mar 21 11:28:05 2017 us=345297 remote_cert_eku = 'TLS Web Server Authentication'
Tue Mar 21 11:28:05 2017 us=345612 ssl_flags = 0
Tue Mar 21 11:28:05 2017 us=345921 tls_timeout = 2
Tue Mar 21 11:28:05 2017 us=346233 renegotiate_bytes = 0
Tue Mar 21 11:28:05 2017 us=347054 renegotiate_packets = 0
Tue Mar 21 11:28:05 2017 us=347392 renegotiate_seconds = 0
Tue Mar 21 11:28:05 2017 us=347784 handshake_window = 120
Tue Mar 21 11:28:05 2017 us=348195 transition_window = 3600
Tue Mar 21 11:28:05 2017 us=348512 single_session = DISABLED
Tue Mar 21 11:28:05 2017 us=348824 push_peer_info = DISABLED
Tue Mar 21 11:28:05 2017 us=349131 tls_exit = DISABLED
Tue Mar 21 11:28:05 2017 us=349819 tls_auth_file = '/mnt/certstore/hmac.key'
Tue Mar 21 11:28:05 2017 us=350167 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=350482 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=350795 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=351106 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=351410 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=351719 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=352031 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=352340 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=352651 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=352962 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=353269 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=353579 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=353888 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=354199 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=354897 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=355307 pkcs11_protected_authentication = DISABLED
Tue Mar 21 11:28:05 2017 us=355633 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=356058 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=356388 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=356705 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=357020 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=357336 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=357651 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=357971 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=358283 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=358601 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=358916 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=359235 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=359551 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=359862 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=360178 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=360491 pkcs11_private_mode = 00000000
Tue Mar 21 11:28:05 2017 us=360797 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=361106 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=361415 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=361724 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=362035 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=362347 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=362660 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=363583 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=364400 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=364741 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=365057 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=365366 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=365682 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=365995 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=366307 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=366614 pkcs11_cert_private = DISABLED
Tue Mar 21 11:28:05 2017 us=366924 pkcs11_pin_cache_period = -1
Tue Mar 21 11:28:05 2017 us=367231 pkcs11_id = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=367540 pkcs11_id_management = DISABLED
Tue Mar 21 11:28:05 2017 us=367843 client = ENABLED
Tue Mar 21 11:28:05 2017 us=368220 pull = ENABLED
Tue Mar 21 11:28:05 2017 us=368535 auth_user_pass_file = '[UNDEF]'
Tue Mar 21 11:28:05 2017 us=368898 OpenVPN 2.3.8 arm--linux-gnueabi [SSL (PolarSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jul 30 2016
Tue Mar 21 11:28:05 2017 us=369449 library versions: PolarSSL 1.2.13, LZO 2.09
Tue Mar 21 11:28:05 2017 us=371247 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Mar 21 11:28:05 2017 us=533734 Control Channel Authentication: using '/mnt/certstore/hmac.key' as a OpenVPN static key file
Tue Mar 21 11:28:05 2017 us=534217 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:05 2017 us=534648 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:05 2017 us=535144 LZO compression initialized
Tue Mar 21 11:28:05 2017 us=542151 Control Channel MTU parms [ L:1606 D:210 EF:110 EB:0 ET:0 EL:3 ]
Tue Mar 21 11:28:05 2017 us=544320 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Mar 21 11:28:05 2017 us=544957 Data Channel MTU parms [ L:1606 D:1450 EF:106 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Mar 21 11:28:05 2017 us=545330 Fragmentation MTU parms [ L:1606 D:1300 EF:105 EB:143 ET:1 EL:3 AF:3/1 ]
Tue Mar 21 11:28:05 2017 us=545991 Local Options String: 'V4,dev-type tun,link-mtu 1606,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client'
Tue Mar 21 11:28:05 2017 us=546290 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1606,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-server'
Tue Mar 21 11:28:05 2017 us=546939 Local Options hash (VER=V4): '73c06b87'
Tue Mar 21 11:28:05 2017 us=547414 Expected Remote Options hash (VER=V4): 'ad1c1209'
Tue Mar 21 11:28:05 2017 us=547820 UDPv4 link local: [undef]
Tue Mar 21 11:28:05 2017 us=548316 UDPv4 link remote: [AF_INET]192.168.21.17:1194
Tue Mar 21 11:28:05 2017 us=553446 TLS: Initial packet from [AF_INET]192.168.21.17:1194, sid=0b45e9bc 32e4a932
Tue Mar 21 11:28:06 2017 us=665696 VERIFY OK: depth=2, C=DE, ST=RLP, L=ABC, O=1AG
Tue Mar 21 11:28:06 2017 us=667184 VERIFY OK: depth=1, C=DE, ST=RLP, L=ABC, O=1AG, CN=1AG-SUBCA
Tue Mar 21 11:28:06 2017 us=668940 Validating certificate extended key usage
Tue Mar 21 11:28:06 2017 us=669302 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 21 11:28:06 2017 us=669602 VERIFY EKU OK
Tue Mar 21 11:28:06 2017 us=669892 VERIFY OK: depth=0, C=DE, ST=RLP, L=ABC, O=1AG, CN=OpenVPN_Test
Tue Mar 21 11:28:12 2017 us=443375 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1638'
Tue Mar 21 11:28:12 2017 us=443826 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Tue Mar 21 11:28:12 2017 us=449158 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 21 11:28:12 2017 us=449706 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:12 2017 us=450453 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 21 11:28:12 2017 us=450891 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:12 2017 us=452099 Control Channel: TLSv1.0, cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA, 2048 bit RSA
Tue Mar 21 11:28:12 2017 us=452644 [OpenVPN_Test] Peer Connection Initiated with [AF_INET]192.168.21.17:1194
Tue Mar 21 11:28:14 2017 us=859154 SENT CONTROL [OpenVPN_Hansewerk_AG_Test]: 'PUSH_REQUEST' (status=1)
Tue Mar 21 11:28:14 2017 us=872920 PUSH: Received control message: 'PUSH_REPLY,route 192.0.0.0 255.0.0.0,route-gateway 192.168.202.1,topology subnet,ping 5,ping-restart 30,ifconfig 192.168.202.2 255.255.255.0'
Tue Mar 21 11:28:14 2017 us=873807 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 21 11:28:14 2017 us=874124 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 21 11:28:14 2017 us=874707 OPTIONS IMPORT: route options modified
Tue Mar 21 11:28:14 2017 us=875043 OPTIONS IMPORT: route-related options modified
Tue Mar 21 11:28:14 2017 us=876776 ROUTE: default_gateway=UNDEF
Tue Mar 21 11:28:14 2017 us=881078 TUN/TAP device tun2 opened
Tue Mar 21 11:28:14 2017 us=881501 TUN/TAP TX queue length set to 100
Tue Mar 21 11:28:14 2017 us=881885 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 21 11:28:14 2017 us=882479 /usr/sbin/ifconfig tun5 192.168.202.2 netmask 255.255.255.0 mtu 1500 broadcast 192.168.202.255
Tue Mar 21 11:28:14 2017 us=915747 /usr/sbin/route add -net 192.0.0.0 netmask 255.0.0.0 gw 192.168.202.1
Tue Mar 21 11:28:15 2017 us=17016 Initialization Sequence Completed
Tue Mar 21 11:28:53 2017 us=727392 VERIFY OK: depth=2, C=DE, ST=RLP, L=ABC, O=1AG
Tue Mar 21 11:28:53 2017 us=728907 VERIFY OK: depth=1, C=DE, ST=RLP, L=ABC, O=1AG, CN=1AG-SUBCA
Tue Mar 21 11:28:53 2017 us=731238 Validating certificate extended key usage
Tue Mar 21 11:28:53 2017 us=731572 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 21 11:28:53 2017 us=731862 VERIFY EKU OK
Tue Mar 21 11:28:53 2017 us=732145 VERIFY OK: depth=0, C=DE, ST=RLP, L=ABC, O=1AG, CN=OpenVPN_Test
Tue Mar 21 11:28:59 2017 us=615268 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1638'
Tue Mar 21 11:28:59 2017 us=615718 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Tue Mar 21 11:28:59 2017 us=619901 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 21 11:28:59 2017 us=620337 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:59 2017 us=620705 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 21 11:28:59 2017 us=621134 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Mar 21 11:28:59 2017 us=622350 Control Channel: TLSv1.0, cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA, 2048 bit RSA
pinging server while key negotiation is in progress:
PING 192.168.202.1 (192.168.202.1): 56 data bytes
64 bytes from 192.168.202.1: icmp_seq=0 ttl=64 time=3.495 ms
64 bytes from 192.168.202.1: icmp_seq=1 ttl=64 time=12.010 ms
64 bytes from 192.168.202.1: icmp_seq=2 ttl=64 time=2.819 ms
64 bytes from 192.168.202.1: icmp_seq=3 ttl=64 time=2.704 ms
...
64 bytes from 192.168.202.1: icmp_seq=32 ttl=64 time=2.738 ms
64 bytes from 192.168.202.1: icmp_seq=33 ttl=64 time=3.065 ms
64 bytes from 192.168.202.1: icmp_seq=34 ttl=64 time=9.212 ms
64 bytes from 192.168.202.1: icmp_seq=35 ttl=64 time=5967.071 ms
64 bytes from 192.168.202.1: icmp_seq=36 ttl=64 time=4968.918 ms
64 bytes from 192.168.202.1: icmp_seq=37 ttl=64 time=3971.003 ms
64 bytes from 192.168.202.1: icmp_seq=38 ttl=64 time=2971.100 ms
64 bytes from 192.168.202.1: icmp_seq=39 ttl=64 time=1971.436 ms
64 bytes from 192.168.202.1: icmp_seq=40 ttl=64 time=971.592 ms
64 bytes from 192.168.202.1: icmp_seq=41 ttl=64 time=3.657 ms
64 bytes from 192.168.202.1: icmp_seq=42 ttl=64 time=3.243 ms
64 bytes from 192.168.202.1: icmp_seq=43 ttl=64 time=2.853 ms
64 bytes from 192.168.202.1: icmp_seq=44 ttl=64 time=2.665 ms
64 bytes from 192.168.202.1: icmp_seq=45 ttl=64 time=2.728 ms
64 bytes from 192.168.202.1: icmp_seq=46 ttl=64 time=3.231 ms
64 bytes from 192.168.202.1: icmp_seq=47 ttl=64 time=2.800 ms
^C--- 192.168.202.1 ping statistics ---
48 packets transmitted, 48 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.665/436.678/5967.071/1295.590 ms
