VPN: killed expiring key for some clients, not all Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) Come Celebrate our 10 Year Anniversary!Unable to logon to vpnProblems setting up a VPN: can connect but can't ping anyoneSamba over OpenVPN - horribly slowSome clients on a VPN network are not reachableFix 'TLS Error: TLS handshake failed' on OpenVPN clientopenvpn, option tls-cipher not working, no shared cipherServer 2012 - OpenVPN 2.3 64-bit - very slow (10mbps only to clients)tls error : tls handshake failedOpenVPN and multicast routingOpenVPN using TAP with a dummy interface
Is it common practice to audition new musicians one-on-one before rehearsing with the entire band?
Extracting terms with certain heads in a function
Is it ethical to give a final exam after the professor has quit before teaching the remaining chapters of the course?
Do jazz musicians improvise on the parent scale in addition to the chord-scales?
In what way is everyone not a utilitarian
How to compare two different files line by line in unix?
What is the meaning of the simile “quick as silk”?
How do I stop a creek from eroding my steep embankment?
How to Make a Beautiful Stacked 3D Plot
Fundamental Solution of the Pell Equation
Why wasn't DOSKEY integrated with COMMAND.COM?
Trademark violation for app?
How do pianists reach extremely loud dynamics?
Is there such thing as an Availability Group failover trigger?
What font is "z" in "z-score"?
Do square wave exist?
How to answer "Have you ever been terminated?"
What would be the ideal power source for a cybernetic eye?
How do I make this wiring inside cabinet safer? (Pic)
old style "caution" boxes
Most bit efficient text communication method?
What does "lightly crushed" mean for cardamon pods?
Is grep documentation wrong?
Can you use the Shield Master feat to shove someone before you make an attack by using a Readied action?
VPN: killed expiring key for some clients, not all
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Unable to logon to vpnProblems setting up a VPN: can connect but can't ping anyoneSamba over OpenVPN - horribly slowSome clients on a VPN network are not reachableFix 'TLS Error: TLS handshake failed' on OpenVPN clientopenvpn, option tls-cipher not working, no shared cipherServer 2012 - OpenVPN 2.3 64-bit - very slow (10mbps only to clients)tls error : tls handshake failedOpenVPN and multicast routingOpenVPN using TAP with a dummy interface
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a VPN server running with +-150 connected users at any given time. While investigating a connectivity issue, I noticed that the clients suffering from connectivity problems had the following error message:
TLS: tls_process: killed expiring key
I understand what this error means and how the process in general works:
In SSL/TLS mode, an SSL session is established with bidirectional
authentication (i.e. each side of the connection must present its own
certificate). If the SSL/TLS authentication succeeds,
encryption/decryption and HMAC key source material is then randomly
generated by OpenSSL's RAND_bytes function and exchanged over the
SSL/TLS connection.
I do however, see these in the logs:
Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
But these are the only ones mentioning anything about this. I never see the USING message, which might be the cause of this, right?
I was wondering, why do some clients have this in the server logs, while others don't have this error message. Additional, why do the clients that have this error message, reconnect?
vpn openvpn
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
add a comment |
I have a VPN server running with +-150 connected users at any given time. While investigating a connectivity issue, I noticed that the clients suffering from connectivity problems had the following error message:
TLS: tls_process: killed expiring key
I understand what this error means and how the process in general works:
In SSL/TLS mode, an SSL session is established with bidirectional
authentication (i.e. each side of the connection must present its own
certificate). If the SSL/TLS authentication succeeds,
encryption/decryption and HMAC key source material is then randomly
generated by OpenSSL's RAND_bytes function and exchanged over the
SSL/TLS connection.
I do however, see these in the logs:
Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
But these are the only ones mentioning anything about this. I never see the USING message, which might be the cause of this, right?
I was wondering, why do some clients have this in the server logs, while others don't have this error message. Additional, why do the clients that have this error message, reconnect?
vpn openvpn
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
add a comment |
I have a VPN server running with +-150 connected users at any given time. While investigating a connectivity issue, I noticed that the clients suffering from connectivity problems had the following error message:
TLS: tls_process: killed expiring key
I understand what this error means and how the process in general works:
In SSL/TLS mode, an SSL session is established with bidirectional
authentication (i.e. each side of the connection must present its own
certificate). If the SSL/TLS authentication succeeds,
encryption/decryption and HMAC key source material is then randomly
generated by OpenSSL's RAND_bytes function and exchanged over the
SSL/TLS connection.
I do however, see these in the logs:
Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
But these are the only ones mentioning anything about this. I never see the USING message, which might be the cause of this, right?
I was wondering, why do some clients have this in the server logs, while others don't have this error message. Additional, why do the clients that have this error message, reconnect?
vpn openvpn
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
I have a VPN server running with +-150 connected users at any given time. While investigating a connectivity issue, I noticed that the clients suffering from connectivity problems had the following error message:
TLS: tls_process: killed expiring key
I understand what this error means and how the process in general works:
In SSL/TLS mode, an SSL session is established with bidirectional
authentication (i.e. each side of the connection must present its own
certificate). If the SSL/TLS authentication succeeds,
encryption/decryption and HMAC key source material is then randomly
generated by OpenSSL's RAND_bytes function and exchanged over the
SSL/TLS connection.
I do however, see these in the logs:
Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
But these are the only ones mentioning anything about this. I never see the USING message, which might be the cause of this, right?
I was wondering, why do some clients have this in the server logs, while others don't have this error message. Additional, why do the clients that have this error message, reconnect?
vpn openvpn
vpn openvpn
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
edited May 28 '18 at 10:49
ThomasVdB
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
asked May 28 '18 at 9:58
ThomasVdBThomasVdB
135
135
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f914092%2fvpn-killed-expiring-key-for-some-clients-not-all%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I had the same issue, I believe the setting for renegotiation time interval reneg-sec which is set to 3600 by default. Hence the vpn clients will renegotiate the key every hour and re-connect. The work around is to set the --reneg-sec config to 0. More information is available here:-
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
answered Apr 12 at 6:56
Atul AjmaniAtul Ajmani
11
11
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Atul Ajmani is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f914092%2fvpn-killed-expiring-key-for-some-clients-not-all%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
