0

I have a VPN server running with +-150 connected users at any given time. While investigating a connectivity issue, I noticed that the clients suffering from connectivity problems had the following error message:

TLS: tls_process: killed expiring key

I understand what this error means and how the process in general works:

In SSL/TLS mode, an SSL session is established with bidirectional authentication (i.e. each side of the connection must present its own certificate). If the SSL/TLS authentication succeeds, encryption/decryption and HMAC key source material is then randomly generated by OpenSSL's RAND_bytes function and exchanged over the SSL/TLS connection.

I do however, see these in the logs:

Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key

Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key

Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA

But these are the only ones mentioning anything about this. I never see the USING message, which might be the cause of this, right?

I was wondering, why do some clients have this in the server logs, while others don't have this error message. Additional, why do the clients that have this error message, reconnect?

1

I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-

https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.