TLS key negotiation and handshake failed

aboka

hi, i follow a guide online(https://kifarunix.com/install-and-setup-openvpn-server-on-ubuntu-20-04/) on howto setup OpenVPN on Ubuntu, that could enable us to create different cert for different user. Hv follow and complete the setup(except the UFW) part as plan to use Iptables after everything is done and works. I manually copy the crt/key files into the ovpn file as that guide didn't teach or hv a script for generating the ovpn. Any help would be appreciate. Below is my ovpn file.Thanks!

The error(on OpenVPN client):

Sat Jul 04 21:20:22 2020 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jul 04 21:20:22 2020 TLS Error: TLS handshake failed

I suspect maybe the path is incorrect, so i change and put the full path. I am on a vps using Ubuntu 20.04

port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/issued/server.crt
key /etc/openvpn/server/private/server.key # This file should be secret
dh /etc/openvpn/server/dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 192.168.2.11"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
auth SHA512

client
dev tun
proto udp
remote 103.102.46.220 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
key-direction 1
comp-lzo
#copy from ca.crt
<ca>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</ca>
#copy from user1.crt
<cert>

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</cert>
#copy from user1.key
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>
#copy from ta.key
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----

-----END OpenVPN Static key V1-----
</tls-auth>

aboka

p/s -hv manage to find openvpn logs and notice alot of this error -
TLS Error: cannot locate HMAC in incoming packet from [AF_INET]121.122.85.174:63609

TinCanTech

aboka wrote TLS Error: cannot locate HMAC

Means you ave probably used the wrong TLS-Auth key on the client.

aboka

hi, i think i hv confuse abit about this certs/key/ca. could you let me know which file should be copy into this section below? maybe i hv use the wrong file on either side:

<ca> server - ca.crt </ca>

<cert> user1 - user1.crt </cert>

<key> user1 - user1.key </key>

<tls-auth> server - ta.key </tls-auth>

thank you,

TinCanTech

TinCanTech wrote Means you ave probably used the wrong TLS-Auth key

:roll:

aboka

TinCanTech wrote
TinCanTech wrote Means you ave probably used the wrong TLS-Auth key
:roll:

hi, thanks for pointing that out. i hv confirm it is related to the TLS part. either hv mess up the path, or file is created wrongly or something like that. as it will works if i comment out/disable the TLS/HMAC part. will re-install everything from scratch when free later.

cheers,