Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a device running ArchLinux and OpenVPN, which was connecting to VPN server without problems until recently. Now it can't connect, with the following output that keeps looping indefinitely:

Is the WARNING message from the log the reason for this? I have checked the link provided in the log: but I am currently using easy-rsa 2.0 to create the certificate and I am using it when connecting.

How can I investigate further? I guess this is not enough data for anyone to really know what is happening, but I am not sure what else to provide, so please say in the comments what else is needed for debugging this issue, and I will edit my question.

Also, now it seems that sometimes I get this error, but I am not sure what is different in such case:

Mar 31 09:39:32 alarmpi openvpn[530]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 31 09:39:32 alarmpi openvpn[530]: TLS Error: TLS handshake failed
Mar 31 09:39:32 alarmpi openvpn[530]: Fatal TLS error (check_tls_errors_co), restarting
Mar 31 09:39:32 alarmpi openvpn[530]: SIGUSR1[soft,tls-error] received, process restarting

As per MadHatter suggestion, I tried connecting via Telnet from the client, and it seems to work:

[root@alarmpi ~]# telnet <SERVER_IP> 443
Trying <SERVER_IP>...
Connected to <SERVER_IP>.
Escape character is '^]'.

It would seem that after the openvpn restart, clients are now able to connect. I am not sure what caused this or how it got overcome, but I can't seem to reproduce this issue at the moment. I will try some more and if I can't reproduce I will delete the question.

share|improve this question
At the moment, the issue seems to be much lower-level than certificate issues; basic connectivity seems to be failing. Handily, you seem to be using TCP on server port 443; could you try from the client telnet server.ip.address 443, and paste the results into your question? – MadHatter Mar 31 '14 at 11:24
@MadHatter: It seems to work, as described in my update. – bosnjak Mar 31 '14 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.