Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a device running ArchLinux and OpenVPN, which was connecting to VPN server without problems until recently. Now it can't connect, with the following output that keeps looping indefinitely: http://pastebin.com/BU6aiBVn

Is the WARNING message from the log the reason for this? I have checked the link provided in the log: http://openvpn.net/howto.html#mitm but I am currently using easy-rsa 2.0 to create the certificate and I am using it when connecting.

How can I investigate further? I guess this is not enough data for anyone to really know what is happening, but I am not sure what else to provide, so please say in the comments what else is needed for debugging this issue, and I will edit my question.

Also, now it seems that sometimes I get this error, but I am not sure what is different in such case:

Mar 31 09:39:32 alarmpi openvpn[530]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 31 09:39:32 alarmpi openvpn[530]: TLS Error: TLS handshake failed
Mar 31 09:39:32 alarmpi openvpn[530]: Fatal TLS error (check_tls_errors_co), restarting
Mar 31 09:39:32 alarmpi openvpn[530]: SIGUSR1[soft,tls-error] received, process restarting

As per MadHatter suggestion, I tried connecting via Telnet from the client, and it seems to work:

[root@alarmpi ~]# telnet <SERVER_IP> 443
Trying <SERVER_IP>...
Connected to <SERVER_IP>.
Escape character is '^]'.

It would seem that after the openvpn restart, clients are now able to connect. I am not sure what caused this or how it got overcome, but I can't seem to reproduce this issue at the moment. I will try some more and if I can't reproduce I will delete the question.

share|improve this question
At the moment, the issue seems to be much lower-level than certificate issues; basic connectivity seems to be failing. Handily, you seem to be using TCP on server port 443; could you try from the client telnet server.ip.address 443, and paste the results into your question? –  MadHatter Mar 31 '14 at 11:24
@MadHatter: It seems to work, as described in my update. –  bosnj Mar 31 '14 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.