TLS handshake failed - need help with debugging

upsudemi

Hello
i am new to OpenVPN and also new to this Forum. I am trying to set up a OpenVPN Server with username and passwort authentification. and so far i managed to install and configure on my own. but now i need help. I have two questions:

1 ) I accidentally started a second OpenVPN tunnelling deamon instance called openvpn@server.sevice.service because of a simple typo :? . and i dont know how to stop, delete or kill it. any ideas? (see SERVICE OPENVPN STATUS at the bottom of this post)

2 ) I have trouble with the TLS Handshake. i always get
"TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) "
and
"TLS Error: TLS handshake failed"
Is there a problem with the inline ca-cert?

i would be very happy if someone with a little more experience could take a look at my configs and logs.
big thanks already 🙂
Anna

Server OS: OpenSUSE Leap 15.0
Client OS: Windows 10.0.17134

SERVER CONFIG:

#local host
local xxx.xxx.xxx.xxx

#port number
port 1194

#tcp or udp server with IPv4 only
proto udp4

#interface type, tun or tap
dev tun

#certificates

ca ca.crt
cert server.crt
#secret key
key server.key

#diffie hellman parameters
dh dh.pem

#subnet to use for openvpn connections
server xxx.xxx.xxx.xxx 255.255.255.0

#keepalive: send ping every 10 sec, tunnel down after 120 seconds no response
keepalive 10 120

#crypogrpfic cipher (must be in client.config as well.)
cipher AES-256-CBC

#lzo comression for the tunnel(must be in client.conf as well)
comp-lzo

#drop privileges to user/group nobody
user nobody
group nobody

#makes the link more resistant to connection failures
persist-key
persist-tun

#username and passwort authentication
username-as-common-name
#client-cert-not-required
#verify-client-cert none
#plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login
#auth-user-pass-verify "/etc/openvpn/example.sh" via-file
#script-security 3
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
auth-nocache

#openvpn status logfile
status openvpn-status.log

#openvpn server log
log openvpn-server.log

#log file verbosity
# 0 silent, exept fatal errors
# 4 reasonable for general usage
# 5 and 6 can help to debug connection problems
# extremly verbose
verb 5

#notify client when server retarts so it automaticcaly reconnects
explicit-exit-notify 1

CLIENT CONFIG:

# OpenVPN Konfiguration Client
# entspricht den Direktiven: tls-client und pull
client

# Protokoll UDP
dev tun

# OpenVPN Gateway
remote xxx.xx-xx.de 1194 udp4

# don't bind to specific port
nobind

# Check server certificate-type
# remote-cert-eku "TLS Web Server Authentication"

# Für OpenVPN 2.3 und zur Vermeidung Irreführender Warnmeldungen
# unter OpenVPN >= 2.4 (dort wird cipher ausgehandelt mit Server)
cipher AES-256-CBC

#lzo compression for the tunnel
comp-lzo

# Don't bind a local port
nobind

# Never give up trying to connect to theserver
# (useful for unreliable internet connections and laptops)
resolv-retry infinite

# Preserve state across restarts.
persist-key
persist-tun

# HMAC-Algorithmus (Control-Channel) auf guten default für OpenVPN 2.3 festlegen
# Unter OpenVPN >= 2.4 wird er, unter Verwendung einer GCM-TLS-Cipher, ignoriert
auth SHA256

# Set output verbosity to n. 3 is recommended
verb 5

# Zum Debugging auskommentieren
mute 50

# Authentification with User and Passwort
auth-user-pass

# verhindert Speicherung der Passwörter im Speicher - Passwörter müssen dann regelmäßig neu eingegeben werden
;auth-nocache

<ca>
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIJAIFAAuwcJ07NMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNV
BAMMCnZwbi1zZXJ2ZXIwHhcNMTkwNDEyMTI1MzQwWhcNMjkwNDA5MTI1MzQwWjAV
MRMwEQYDVQQDDAp2cG4tc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA8Hh3r/+UYEq/iE5ElbC+GSZi6EUAWBkq455Gk239AEZnFIxkih6JfdxG
wVYa9SKwkRCCX8YM3SIHGzI6NyZpzjlwDrrM4XgqeKVPQpL+7H7VcU0Kn0DDSTVh
F9RovOHnVXxFa7QSTJUrOqqlntYYVTeQ7vRcC3isKsEZftmahfz6OtTsEcsRrV7U
dGgFI0iB+BcH5lRHIeZl0cYSAOLJ1gqrm96sEuSNaVJ8wU5Kmf9sJb9qzMKGE6cU
EzCgWKJIxPbAkBm7H7f9oUoSX9Pqf2bRXPX9KfzcQIkozF6uJY94k/2ZW+u7Dluy
km8DDNyx/iC6+nyCkCmjF7xnQ9PNfQIDAQABo4GEMIGBMB0GA1UdDgQWBBTb4vhr
aVYbt4ssemTT/5X6CH+KeTBFBgNVHSMEPjA8gBTb4vhraVYbt4ssemTT/5X6CH+K
eaEZpBcwFTETMBEGA1UEAwwKdnBuLXNlcnZlcoIJAIFAAuwcJ07NMAwGA1UdEwQF
MAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQCHZmTtm7ssQqi0
LL1sCuPdk+ro3GYaH6WD2sDGvXacjbJVs5zZ4R3BenOy1TljmXktyLHplIHcQ+nQ
QI5/zGz3IAd61Xko8zwXT9Ks42zDQZgHxBreWyIstittbRp2+CScrH8eDHl5KJqn
Wne9O3/4YIOpc0li3xOwcOQf7O5vXsZD3I0ri7/bMKscELl+Z3Y0XGrO+aRoTymR
2DnGQuELj8yDitALAK8sNP+9oBNgnnyOHYFGsO/unf7Yzh0tjLBymqLLNlhGQ4zm
EnxtsDJeJLbrLzKcoL9Fg6qlxYMK4O53QsfpLyYDp+ZU5KV4yXpOen4s/5iJpQQZ
0zD+iEm7
-----END CERTIFICATE-----
</ca>

SERVER LOG:

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp4
  local = '193.xxx.xxx.xx'
  local_port = '1194'
  remote = '[UNDEF]'
  remote_port = '1194'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 1
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 1
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '10.8.0.2'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = 'nobody'
  groupname = 'nobody'
  chroot_dir = '[UNDEF]'
  cd_dir = '/etc/openvpn/'
  writepid = '/run/openvpn/server.pid'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = ENABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 5
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 1
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  comp.alg = 2
  comp.flags = 1
  route_script = '[UNDEF]'
  route_default_gateway = '[UNDEF]'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  route 10.8.0.0/255.255.255.0/default (not set)/default (not set)
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  plugin[0] /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so '[/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so] [openvpn]'
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
  authname = 'SHA1'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh.pem'
  cert_file = 'server.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'server.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 4
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = '[UNDEF]'
  tls_crypt_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'route 10.8.0.1'
  push_entry = 'topology net30'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.4
  ifconfig_pool_end = 10.8.0.251
  ifconfig_pool_netmask = 0.0.0.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.3 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 20 2017
library versions: OpenSSL 1.1.0i-fips  14 Aug 2018, LZO 2.10
AUTH-PAM: BACKGROUND: INIT service='openvpn'
PLUGIN_INIT: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so '[/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
Diffie-Hellman initialized with 2048 bit key
TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
ROUTE_GATEWAY 193.xxx.yyy.zz/255.255.255.240 IFACE=eth0 HWADDR=00:50:56:a8:3b:0e
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/bin/ip link set dev tun0 up mtu 1500
/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
/bin/ip route add 10.8.0.0/24 via 10.8.0.2
Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET]193.xxx.yyy.zz:1194
UDPv4 link remote: [AF_UNSPEC]
GID set to nobody
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Initialization Sequence Completed
MULTI: multi_create_instance called
193.xxx.yyy.zz:52016 Re-using SSL/TLS context
193.xxx.yyy.zz:52016 LZO compression initializing
193.xxx.yyy.zz:52016 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
193.xxx.yyy.zz:52016 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
193.xxx.yyy.zz:52016 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
193.xxx.yyy.zz:52016 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
R193.xxx.yyy.zz:52016 TLS: Initial packet from [AF_INET]193.xxx.yyy.zz:52016, sid=6cfde6e7 e82d98e1
WRRWWRR193.xxx.yyy.zz:52016 OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate
193.xxx.yyy.zz:52016 TLS_ERROR: BIO read tls_read_plaintext error
193.xxx.yyy.zz:52016 TLS Error: TLS object -> incoming plaintext read error
193.xxx.yyy.zz:52016 TLS Error: TLS handshake failed
193.xxx.yyy.zz:52016 SIGUSR1[soft,tls-error] received, client-instance restarting

CLIENT LOG:

Tue Apr 23 15:35:16 2019 us=166038 Current Parameter Settings:
Tue Apr 23 15:35:16 2019 us=168001   config = 'C:\Users\ama\OpenVPN\config\xxx\xxx- backup.ovpn'
Tue Apr 23 15:35:16 2019 us=168001   mode = 0
Tue Apr 23 15:35:16 2019 us=168001   show_ciphers = DISABLED
Tue Apr 23 15:35:16 2019 us=168001   show_digests = DISABLED
Tue Apr 23 15:35:16 2019 us=168001   show_engines = DISABLED
Tue Apr 23 15:35:16 2019 us=168001   genkey = DISABLED
Tue Apr 23 15:35:16 2019 us=168966   key_pass_file = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=168966   show_tls_ciphers = DISABLED
Tue Apr 23 15:35:16 2019 us=168966   connect_retry_max = 0
Tue Apr 23 15:35:16 2019 us=168966 Connection profiles [0]:
Tue Apr 23 15:35:16 2019 us=168966   proto = udp4
Tue Apr 23 15:35:16 2019 us=168966   local = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=168966   local_port = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=168966   remote = 'xxx.xx-xx.de'
Tue Apr 23 15:35:16 2019 us=169939   remote_port = '1194'
Tue Apr 23 15:35:16 2019 us=169939   remote_float = DISABLED
Tue Apr 23 15:35:16 2019 us=169939   bind_defined = DISABLED
Tue Apr 23 15:35:16 2019 us=169939   bind_local = DISABLED
Tue Apr 23 15:35:16 2019 us=169939   bind_ipv6_only = DISABLED
Tue Apr 23 15:35:16 2019 us=169939   connect_retry_seconds = 5
Tue Apr 23 15:35:16 2019 us=169939   connect_timeout = 120
Tue Apr 23 15:35:16 2019 us=170915   socks_proxy_server = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=170915   socks_proxy_port = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=170915   tun_mtu = 1500
Tue Apr 23 15:35:16 2019 us=170915   tun_mtu_defined = ENABLED
Tue Apr 23 15:35:16 2019 us=170915   link_mtu = 1500
Tue Apr 23 15:35:16 2019 us=170915   link_mtu_defined = DISABLED
Tue Apr 23 15:35:16 2019 us=170915   tun_mtu_extra = 0
Tue Apr 23 15:35:16 2019 us=170915   tun_mtu_extra_defined = DISABLED
Tue Apr 23 15:35:16 2019 us=170915   mtu_discover_type = -1
Tue Apr 23 15:35:16 2019 us=171892   fragment = 0
Tue Apr 23 15:35:16 2019 us=171892   mssfix = 1450
Tue Apr 23 15:35:16 2019 us=172868   explicit_exit_notification = 0
Tue Apr 23 15:35:16 2019 us=179714 Connection profiles END
Tue Apr 23 15:35:16 2019 us=180674   remote_random = DISABLED
Tue Apr 23 15:35:16 2019 us=180674   ipchange = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=181653   dev = 'tun'
Tue Apr 23 15:35:16 2019 us=182631   dev_type = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=183609   dev_node = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=184583   lladdr = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=185557   topology = 1
Tue Apr 23 15:35:16 2019 us=185557   ifconfig_local = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=186532   ifconfig_remote_netmask = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=187527   ifconfig_noexec = DISABLED
Tue Apr 23 15:35:16 2019 us=187527   ifconfig_nowarn = DISABLED
Tue Apr 23 15:35:16 2019 us=189461   ifconfig_ipv6_local = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=190436   ifconfig_ipv6_netbits = 0
Tue Apr 23 15:35:16 2019 us=190436   ifconfig_ipv6_remote = '[UNDEF]'
Tue Apr 23 15:35:16 2019 us=191414   shaper = 0
Tue Apr 23 15:35:16 2019 us=191414 NOTE: --mute triggered...
Tue Apr 23 15:35:16 2019 us=193372 242 variation(s) on previous 50 message(s) suppressed by --mute
Tue Apr 23 15:35:16 2019 us=194348 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Tue Apr 23 15:35:16 2019 us=194348 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Apr 23 15:35:16 2019 us=194348 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Auth Username:testuser
Enter Auth Password:
Tue Apr 23 15:35:31 2019 us=658255 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Apr 23 15:35:31 2019 us=661184 LZO compression initializing
Tue Apr 23 15:35:31 2019 us=662163 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Tue Apr 23 15:35:31 2019 us=668996 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Apr 23 15:35:31 2019 us=668996 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Tue Apr 23 15:35:31 2019 us=669970 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Tue Apr 23 15:35:31 2019 us=669970 TCP/UDP: Preserving recently used remote address: [AF_INET]193.xxx.xxx.xx:1194
Tue Apr 23 15:35:31 2019 us=670946 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Apr 23 15:35:31 2019 us=670946 UDPv4 link local: (not bound)
Tue Apr 23 15:35:31 2019 us=671924 UDPv4 link remote: [AF_INET]193.xxx.xxx.xxx:1194
WRTue Apr 23 15:35:31 2019 us=676204 TLS: Initial packet from [AF_INET]193.xxx.xxx.xx:1194, sid=31afc927 ad50325c
WWRWRTue Apr 23 15:35:31 2019 us=686792 VERIFY OK: depth=1, CN=vpn-server
Tue Apr 23 15:35:31 2019 us=687758 VERIFY OK: depth=0, CN=server
WWWWWTue Apr 23 15:36:31 2019 us=231236 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Apr 23 15:36:34 2019 us=266342 TLS Error: TLS handshake failed
Tue Apr 23 15:36:34 2019 us=278059 TCP/UDP: Closing socket
Tue Apr 23 15:36:34 2019 us=289767 SIGUSR1[soft,tls-error] received, process restarting
Tue Apr 23 15:36:34 2019 us=289767 Restart pause, 5 second(s)

SERVICE OPENVPN STATUS

 service openvpn status
● openvpn.target - OpenVPN target allowing to start/stop all openvpn@.service instances at once
   Loaded: loaded (/usr/lib/systemd/system/openvpn.target; static; vendor preset: disabled)
   Active: active since Tue 2019-04-23 08:42:06 CEST; 6h ago

Apr 23 08:42:06 ovpn systemd[1]: Reached target OpenVPN target allowing to start/stop all openvpn@.service instances at once.

● openvpn@server.service - OpenVPN tunneling daemon instance using /etc/openvpn/server.conf
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2019-04-23 08:42:06 CEST; 6h ago
  Process: 2899 ExecStart=/usr/sbin/openvpn --daemon --suppress-timestamps --writepid /run/openvpn/server.pid --cd /etc/openvpn/ --config s>
 Main PID: 2900 (openvpn)
    Tasks: 2 (limit: 4915)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           ├─2900 /usr/sbin/openvpn --daemon --suppress-timestamps --writepid /run/openvpn/server.pid --cd /etc/openvpn/ --config server.co>
           └─2902 /usr/sbin/openvpn --daemon --suppress-timestamps --writepid /run/openvpn/server.pid --cd /etc/openvpn/ --config server.co>

Apr 23 08:42:05 ovpn systemd[1]: Starting OpenVPN tunneling daemon instance using /etc/openvpn/server.conf...
Apr 23 08:42:06 ovpn systemd[1]: openvpn@server.service: PID file /run/openvpn/server.pid not readable (yet?) after start: No such file or >
Apr 23 08:42:06 ovpn systemd[1]: Started OpenVPN tunneling daemon instance using /etc/openvpn/server.conf.

● openvpn@server.sevice.service - OpenVPN tunneling daemon instance using /etc/openvpn/server.sevice.conf
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2019-04-15 14:56:35 CEST; 1 weeks 1 days ago

Apr 15 14:56:35 ovpn systemd[1]: Starting OpenVPN tunneling daemon instance using /etc/openvpn/server.sevice.conf...
Apr 15 14:56:35 ovpn openvpn[4534]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.sevice.conf
Apr 15 14:56:35 ovpn openvpn[4534]: Use --help for more information.
Apr 15 14:56:35 ovpn systemd[1]: openvpn@server.sevice.service: Control process exited, code=exited status=1
Apr 15 14:56:35 ovpn systemd[1]: Failed to start OpenVPN tunneling daemon instance using /etc/openvpn/server.sevice.conf.
Apr 15 14:56:35 ovpn systemd[1]: openvpn@server.sevice.service: Unit entered failed state.
Apr 15 14:56:35 ovpn systemd[1]: openvpn@server.sevice.service: Failed with result 'exit-code'.

TinCanTech

You need to read about --client-cert-not-required in the manual.

upsudemi

thank you. i read it and added this to the server.conf

verify-client-cert none

and this to the client.conf

#server certificate verification method
remote-cert-tls server

and now the client connects to the server. yippie! 😃

now i still have the question about how to stop / kill the second OpenVPN tunnelling deamon instance called openvpn@server.sevice.service. i use ssh.