Меню

Read handshake record ошибка

On a Alfresco 7.0 CE repo successfully migrated from 5.2 with a high number of nodes I now get every morning around 4am a database connection exception from org.activiti.engine.impl.jobexecutor.AcquireJobsRunnableImpl which then breaks alfresco. Alfresco is configured against a postres 13 DB running on a separate server. I haven’t seen such an issue before.

Does anybody have a hint, idea?

Alfresco is configured with db.pool.max=350 (postgres: max_connections = 350) and there is only one application user connected the system. As a work around I now deactivated system.workflow.engine.activiti but would like understand the issue

2021-08-08 04:35:39,396 ERROR [org.activiti.engine.impl.jobexecutor.AcquireJobsRunnableImpl] [Thread-46] exception during job acquisition: Could not open JDBC Connection for transaction; nested exception is org.postgresql.util.PSQLException: SSL error: readHandshakeRecord
org.springframework.transaction.CannotCreateTransactionException: Could not open JDBC Connection for transaction; nested exception is org.postgresql.util.PSQLException: SSL error: readHandshakeRecord
        at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:309)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.startTransaction(AbstractPlatformTransactionManager.java:400)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:373)
        at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:137)
        at org.activiti.spring.SpringTransactionInterceptor.execute(SpringTransactionInterceptor.java:45)
        at org.activiti.engine.impl.interceptor.LogInterceptor.execute(LogInterceptor.java:31)
        at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:40)
        at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:35)
        at org.activiti.engine.impl.jobexecutor.AcquireJobsRunnableImpl.run(AcquireJobsRunnableImpl.java:54)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: org.postgresql.util.PSQLException: SSL error: readHandshakeRecord
        at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:43)
        at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:534)
        at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:149)
        at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
        at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
        at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:223)
        at org.postgresql.Driver.makeConnection(Driver.java:465)
        at org.postgresql.Driver.connect(Driver.java:264)
        at org.apache.commons.dbcp.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:38)
        at org.apache.commons.dbcp.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:582)
        at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:1188)
        at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.java:106)
        at org.apache.commons.dbcp.BasicDataSource.getConnection(BasicDataSource.java:1044)
        at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:265)
        ... 9 more
Caused by: javax.net.ssl.SSLException: readHandshakeRecord
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1335)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:411)
        at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:41)
        ... 22 more
        Suppressed: java.net.SocketException: Broken pipe (Write failed)
                at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
                at java.base/java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:110)
                at java.base/java.net.SocketOutputStream.write(SocketOutputStream.java:150)
                at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81)
                at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:380)
                at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
                at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450)
                ... 24 more
Caused by: java.net.SocketException: Broken pipe (Write failed)
        at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
        at java.base/java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:110)
        at java.base/java.net.SocketOutputStream.write(SocketOutputStream.java:150)
        at java.base/sun.security.ssl.SSLSocketOutputRecord.flush(SSLSocketOutputRecord.java:251)
        at java.base/sun.security.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:89)
        at java.base/sun.security.ssl.Finished$T13FinishedProducer.onProduceFinished(Finished.java:679)
        at java.base/sun.security.ssl.Finished$T13FinishedProducer.produce(Finished.java:658)
        at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:436)
        at java.base/sun.security.ssl.Finished$T13FinishedConsumer.onConsumeFinished(Finished.java:1011)
        at java.base/sun.security.ssl.Finished$T13FinishedConsumer.consume(Finished.java:874)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:171)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1418)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1324)
        ... 25 more
org.springframework.transaction.CannotCreateTransactionException: Could not open JDBC Connection for transaction; nested exception is org.postgresql.util.PSQLException: SSL error: Remote host terminated the handshake
        at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:309)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.startTransaction(AbstractPlatformTransactionManager.java:400)
        at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:373)
        at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:137)
        at org.activiti.spring.SpringTransactionInterceptor.execute(SpringTransactionInterceptor.java:45)
        at org.activiti.engine.impl.interceptor.LogInterceptor.execute(LogInterceptor.java:31)
        at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:40)
        at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:35)
        at org.activiti.engine.impl.jobexecutor.AcquireJobsRunnableImpl.run(AcquireJobsRunnableImpl.java:54)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: org.postgresql.util.PSQLException: SSL error: Remote host terminated the handshake
        at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:43)
        at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:534)
        at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:149)
        at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
        at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
        at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:223)
        at org.postgresql.Driver.makeConnection(Driver.java:465)
        at org.postgresql.Driver.connect(Driver.java:264)
        at org.apache.commons.dbcp.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:38)
        at org.apache.commons.dbcp.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:582)
        at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:1188)
        at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.java:106)
        at org.apache.commons.dbcp.BasicDataSource.getConnection(BasicDataSource.java:1044)
        at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:265)
        ... 9 more
Caused by: javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
        at java.base/sun.security.ssl.SSLSocketImpl.handleEOF(SSLSocketImpl.java:1598)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1426)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1324)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:411)
        at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:41)
        ... 22 more
        Suppressed: java.net.SocketException: Broken pipe (Write failed)
                at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
                at java.base/java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:110)
                at java.base/java.net.SocketOutputStream.write(SocketOutputStream.java:150)
                at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81)
                at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:380)
                at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
                at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450)
                ... 24 more
        at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:483)
        at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472)
        at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:110)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1418)
        ... 26 more

Источник

Rishi |
Last updated: Sep 16, 2019 11:15AM UTC

Mike, PortSwigger Agent |
Last updated: Sep 16, 2019 12:57PM UTC

Burp User |
Last updated: Sep 16, 2019 01:50PM UTC

Mike, PortSwigger Agent |
Last updated: Sep 17, 2019 07:27AM UTC

Burp User |
Last updated: Nov 21, 2019 12:03PM UTC

Ben, PortSwigger Agent |
Last updated: Nov 21, 2019 01:36PM UTC

Burp User |
Last updated: Dec 21, 2019 08:07PM UTC

Burp User |
Last updated: Dec 21, 2019 08:11PM UTC

Michelle, PortSwigger Agent |
Last updated: Dec 24, 2019 09:51AM UTC

varghese |
Last updated: Oct 25, 2020 12:06AM UTC

Liam, PortSwigger Agent |
Last updated: Oct 26, 2020 07:51AM UTC

Rahul |
Last updated: Nov 19, 2020 12:39AM UTC

Liam, PortSwigger Agent |
Last updated: Nov 19, 2020 09:55AM UTC

Источник

VoidrayX

OpenVpn Newbie
Posts: 4
Joined: Sun Jul 12, 2015 11:21 am

[Solved]TLS Error:reading acknowledgement record from packet

Hosting the server behind my dlink DIR-868L Router on my Windows 8.1 PC
Port forwarded UDP 1194
When I connect to the server using android i get

Code: Select all

TLS Error: reading acknowledgement record from packet

Then I tried using static mini, I could connect however there was no internet access
Please Help! Im only know the the basic terms and stuff so try to keep the instructions simple.
Thanks!

Heres my server config

Code: Select all

port 1194
proto udp
dev tun
ca "C:\Program Files\OpenVPN\easy-rsa\keys\ca.crt"
cert "C:\Program Files\OpenVPN\easy-rsa\keys\server.crt"
key "C:\Program Files\OpenVPN\easy-rsa\keys\server.key"  # This file should be kept secret
dh "C:\Program Files\OpenVPN\easy-rsa\keys\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

And Client config

Code: Select all

client
dev tun
proto udp
remote XXX.XXX.XX.48 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
comp-lzo
verb 3

Log

Code: Select all

Sun Jul 12 20:21:02 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [IPv6] built on Jul  9 2015
Sun Jul 12 20:21:02 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Sun Jul 12 20:21:02 2015 NOTE: your local LAN uses the extremely common subnet a
ddress 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conf
licts if you connect to the VPN server from public locations such as internet ca
fes that use the same subnet.
Sun Jul 12 20:21:02 2015 Note: cannot open openvpn-status.log for WRITE
Sun Jul 12 20:21:02 2015 Note: cannot open ipp.txt for READ/WRITE
Sun Jul 12 20:21:02 2015 Diffie-Hellman initialized with 1024 bit key
Sun Jul 12 20:21:02 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jul 12 20:21:02 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jul 12 20:21:02 2015 open_tun, tt->ipv6=0
Sun Jul 12 20:21:02 2015 TAP-WIN32 device [Ethernet 3] opened: \.Global{2CC68
BF1-045D-4F1B-B64E-1D5B14912043}.tap
Sun Jul 12 20:21:02 2015 TAP-Windows Driver Version 9.21
Sun Jul 12 20:21:02 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of
 10.8.0.1/255.255.255.252 on interface {2CC68BF1-045D-4F1B-B64E-1D5B14912043} [D
HCP-serv: 10.8.0.2, lease-time: 31536000]
Sun Jul 12 20:21:02 2015 Sleeping for 10 seconds...
Sun Jul 12 20:21:12 2015 NOTE: FlushIpNetTable failed on interface [44] {2CC68BF
1-045D-4F1B-B64E-1D5B14912043} (status=5) : Access is denied.
Sun Jul 12 20:21:12 2015 C:WINDOWSsystem32route.exe ADD 10.8.0.0 MASK 255.255
.255.0 10.8.0.2
Sun Jul 12 20:21:12 2015 ROUTE: route addition failed using CreateIpForwardEntry
: Access is denied.   [status=5 if_index=44]
Sun Jul 12 20:21:12 2015 Route addition via IPAPI failed [adaptive]
Sun Jul 12 20:21:12 2015 Route addition fallback to route.exe
Sun Jul 12 20:21:12 2015 env_block: add PATH=C:WindowsSystem32;C:WINDOWS;C:W
INDOWSSystem32Wbem
Sun Jul 12 20:21:12 2015 ERROR: Windows route add command failed [adaptive]: ret
urned error code 1
Sun Jul 12 20:21:12 2015 UDPv4 link local (bound): [undef]
Sun Jul 12 20:21:12 2015 UDPv4 link remote: [undef]
Sun Jul 12 20:21:12 2015 MULTI: multi_init called, r=256 v=256
Sun Jul 12 20:21:12 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Jul 12 20:21:12 2015 IFCONFIG POOL LIST
Sun Jul 12 20:21:12 2015 Initialization Sequence Completed
Sun Jul 12 20:21:33 2015 192.168.0.1:57837 TLS: Initial packet from [AF_INET]192
.168.0.1:57837, sid=2c8a2582 5527d384
Sun Jul 12 20:21:33 2015 192.168.0.103:57837 TLS: Initial packet from [AF_INET]1
92.168.0.103:57837, sid=2c8a2582 5527d384
Sun Jul 12 20:21:35 2015 192.168.0.103:57837 TLS Error: reading acknowledgement
record from packet
Sun Jul 12 20:21:40 2015 192.168.0.103:57837 TLS Error: reading acknowledgement
record from packet
Sun Jul 12 20:21:47 2015 192.168.0.103:57837 TLS Error: reading acknowledgement
record from packet
Sun Jul 12 20:22:03 2015 192.168.0.103:57837 TLS Error: reading acknowledgement
record from packet
Sun Jul 12 20:22:31 2015 192.168.0.1:33974 TLS: Initial packet from [AF_INET]192
.168.0.1:33974, sid=2bf071de 28bcbad4
Sun Jul 12 20:22:33 2015 192.168.0.103:57837 TLS Error: TLS key negotiation fail
ed to occur within 60 seconds (check your network connectivity)
Sun Jul 12 20:22:33 2015 192.168.0.103:57837 TLS Error: TLS handshake failed
Sun Jul 12 20:22:33 2015 192.168.0.103:57837 SIGUSR1[soft,tls-error] received, c
lient-instance restarting
Sun Jul 12 20:22:33 2015 192.168.0.1:57837 TLS Error: TLS key negotiation failed
 to occur within 60 seconds (check your network connectivity)
Sun Jul 12 20:22:33 2015 192.168.0.1:57837 TLS Error: TLS handshake failed
Sun Jul 12 20:22:33 2015 192.168.0.1:57837 SIGUSR1[soft,tls-error] received, cli
ent-instance restarting
Sun Jul 12 20:23:01 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (c
ode=10054)
Sun Jul 12 20:23:31 2015 192.168.0.1:33974 TLS Error: TLS key negotiation failed
 to occur within 60 seconds (check your network connectivity)
Sun Jul 12 20:23:31 2015 192.168.0.1:33974 TLS Error: TLS handshake failed
Sun Jul 12 20:23:31 2015 192.168.0.1:33974 SIGUSR1[soft,tls-error] received, cli
ent-instance restarting

User avatar

Traffic

OpenVPN Protagonist
Posts: 4071
Joined: Sat Aug 09, 2014 11:24 am

Re: TLS Error: reading acknowledgement record from packet

Post

by Traffic » Sun Jul 12, 2015 4:29 pm

Did you run your server as administrator ?

VoidrayX

OpenVpn Newbie
Posts: 4
Joined: Sun Jul 12, 2015 11:21 am

Re: TLS Error: reading acknowledgement record from packet

Post

by VoidrayX » Mon Jul 13, 2015 10:22 am

Traffic wrote:Did you run your server as administrator ?

Hello, I couldnt find an option to run it as administrator so i did openvpn server.ovpn using the administrator CMD
Didnt seem to make a difference.
Heres the log anyway

Code: Select all

C:WINDOWSsystem32>cd "C:Program FilesOpenVPNbin"

C:Program FilesOpenVPNbin>openvpn server.ovpn
Mon Jul 13 18:18:36 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [IPv6] built on Jul  9 2015
Mon Jul 13 18:18:36 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Mon Jul 13 18:18:36 2015 NOTE: your local LAN uses the extremely common subnet a
ddress 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conf
licts if you connect to the VPN server from public locations such as internet ca
fes that use the same subnet.
Mon Jul 13 18:18:36 2015 Diffie-Hellman initialized with 1024 bit key
Mon Jul 13 18:18:36 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Jul 13 18:18:36 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 13 18:18:36 2015 open_tun, tt->ipv6=0
Mon Jul 13 18:18:36 2015 TAP-WIN32 device [Ethernet 3] opened: \.Global{2CC68
BF1-045D-4F1B-B64E-1D5B14912043}.tap
Mon Jul 13 18:18:36 2015 TAP-Windows Driver Version 9.21
Mon Jul 13 18:18:36 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of
 10.8.0.1/255.255.255.252 on interface {2CC68BF1-045D-4F1B-B64E-1D5B14912043} [D
HCP-serv: 10.8.0.2, lease-time: 31536000]
Mon Jul 13 18:18:36 2015 Sleeping for 10 seconds...
Mon Jul 13 18:18:46 2015 Successful ARP Flush on interface [44] {2CC68BF1-045D-4
F1B-B64E-1D5B14912043}
Mon Jul 13 18:18:46 2015 C:WINDOWSsystem32route.exe ADD 10.8.0.0 MASK 255.255
.255.0 10.8.0.2
Mon Jul 13 18:18:46 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMet
ric1=20 and dwForwardType=4
Mon Jul 13 18:18:46 2015 Route addition via IPAPI succeeded [adaptive]
Mon Jul 13 18:18:46 2015 UDPv4 link local (bound): [undef]
Mon Jul 13 18:18:46 2015 UDPv4 link remote: [undef]
Mon Jul 13 18:18:46 2015 MULTI: multi_init called, r=256 v=256
Mon Jul 13 18:18:46 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Jul 13 18:18:46 2015 IFCONFIG POOL LIST
Mon Jul 13 18:18:46 2015 Initialization Sequence Completed
Mon Jul 13 18:20:01 2015 192.168.0.1:53192 TLS: Initial packet from [AF_INET]192
.168.0.1:53192, sid=be4096f3 326efc01
Mon Jul 13 18:20:01 2015 192.168.0.103:53192 TLS: Initial packet from [AF_INET]1
92.168.0.103:53192, sid=be4096f3 326efc01
Mon Jul 13 18:20:01 2015 192.168.0.103:53192 TLS Error: reading acknowledgement
record from packet
Mon Jul 13 18:20:03 2015 192.168.0.103:53192 TLS Error: reading acknowledgement
record from packet
Mon Jul 13 18:20:07 2015 192.168.0.103:53192 TLS Error: reading acknowledgement
record from packet
Mon Jul 13 18:20:15 2015 192.168.0.103:53192 TLS Error: reading acknowledgement
record from packet
Mon Jul 13 18:20:20 2015 C:WINDOWSsystem32route.exe DELETE 10.8.0.0 MASK 255.
255.255.0 10.8.0.2
Mon Jul 13 18:20:20 2015 Route deletion via IPAPI succeeded [adaptive]
Mon Jul 13 18:20:20 2015 Closing TUN/TAP interface
Mon Jul 13 18:20:20 2015 SIGTERM[hard,] received, process exiting

C:Program FilesOpenVPNbin>

User avatar

maikcat

Forum Team
Posts: 4200
Joined: Wed Jan 12, 2011 9:23 am
Location: Athens,Greece
Contact:

Re: TLS Error: reading acknowledgement record from packet

Post

by maikcat » Tue Jul 14, 2015 6:42 am

When I connect to the server using android i get

is your android located in the same network with your openvpn server?

Michael.

VoidrayX

OpenVpn Newbie
Posts: 4
Joined: Sun Jul 12, 2015 11:21 am

Re: TLS Error: reading acknowledgement record from packet

Post

by VoidrayX » Tue Jul 14, 2015 10:59 am

maikcat wrote:

When I connect to the server using android i get

is your android located in the same network with your openvpn server?

Michael.

It is when i try to test connection to the server. It worked when trying with a static server.

And these mod approval take sooooo long

User avatar

maikcat

Forum Team
Posts: 4200
Joined: Wed Jan 12, 2011 9:23 am
Location: Athens,Greece
Contact:

Re: TLS Error: reading acknowledgement record from packet

Post

by maikcat » Thu Jul 16, 2015 10:59 am

It is when i try to test connection to the server. It worked when trying with a static server.

avoid connecting to your routers wan ip while in the lan,

use a different internet connection for your tests.

And these mod approval take sooooo long

2 things about that,

your first posts only require approval , not ALL of them

i am the only active mod (hopefully i am not) with a full time job and a family , be patient.

Michael.

VoidrayX

OpenVpn Newbie
Posts: 4
Joined: Sun Jul 12, 2015 11:21 am

Re: TLS Error: reading acknowledgement record from packet

Post

by VoidrayX » Fri Jul 17, 2015 1:02 am

maikcat wrote:

It is when i try to test connection to the server. It worked when trying with a static server.

avoid connecting to your routers wan ip while in the lan,

use a different internet connection for your tests.

I tested over mobile data and it worked! Thanks alot for the help

Источник

Содержание

  1. linux-notes.org
  2. Решение некоторых проблем с handshake (рукопожатием) SSL/TLS
  3. Ошибка «SSL_do_handshake errors с nginx или haproxy»
  4. Mozilla
  5. Chapter 8 NSS and SSL Error Codes
  6. SSL Error Codes
  7. SEC Error Codes

linux-notes.org

Handshake (рукопожатие) SSL/TLS состоит из того, что сервер и клиент идентифицируют друг друга и начинают общение через шифрованный SSL/TLS-туннель (который является безопасным).

Данный процесс и называется handshak-ом или рукопожатием из-за того, что они (сервер и клиент) видятся первый раз. Такой процесс, начинается с идентификации и заканчивается генерированием секретного ключа.

Что такое SSL/TLS-рукопожатие?

SSL handshake – это общение сервера и клиента между собой, где каждый хочет достичь одной и той же цели – безопасно общаться с помощью симметричного шифрования. При таком шифровании у двух сторон один ключ для шифрования и дешифрования сообщений. Такой ключ называется общим секретным – у всех пользователей, которые обмениваются данными, один и тот же ключ.

Принцип работы handshake (рукопожатие) SSL/TLS

Расмотрим диалог сервера и клиента:

Клиент: «Здравствуйте сервер! Я бы хотел установить безопасное соединение между нами. От себя, я отсылаю свои шифры и совместимую SSL/TLS версию».

Сервер: «Здравствуйте, клиент! Я проверил шифр который получил от тебя и SSL/TLS версию, которую ты используешь. Нет повода отсоединятся, так что — продолжаем…. От себя, я хотел бы отправить свой сертификат-файл и публичный ключ. Клиент, проверь их пожалуйста».

Клиент: » Такс, твой сертификат в порядке. Но мне необходимо, чекнуть твой закрытый ключ. Для этого, я сейчас сгенерирую и зашифрую общий секретный ключ с помощью твоего открытого ключа. Выполни расшифровку с помощью своего приватного ключика. Если все пройдет гладко, — ты в свою очередь, создашь главный секрет, который мы в дальнейшем, будем использовать для шифрования и расшифрования информации».

Сервер: «Понял! Все сделано».

С этого момента, когда сервер и клиент доверяют друг другу, то инфу которую они будут передавать между собой, будет зашифрована с помощью главного секрета (После проверок, информация будет зашифрована только через главный секретный ключ).

Клиент: «И так, для тестирования — я отправлю тестовое сообщение, дабы удостоверится, что созданный главный секрет корректно работает. Сервер, ты в свою очередь, когда получишь это тестовое сообщение — отправь мне расшифрованную версию этого сообщения. Если все получится, наши данные — в безопасности».

Сервер: «Да, все прочто отлично. Работает!».

Вот такое вот SSL/TLS-рукопожатие. С этого момента, когда сервер и клиент будут передавать файлы, они будут зашифрованы.

Решение некоторых проблем с handshake (рукопожатием) SSL/TLS

Ошибка «SSL_do_handshake errors с nginx или haproxy»

Если вы загружаете https трафик с haproxy в tcp-режиме, и вы выполняете это с помощью nginx, и вы получаете 502 ошибки, сопровождаемые этими ошибками SSL в журнале ошибок nginx:

То вам нужно отключить опцию proxy_ssl_session_reuse:

По умолчанию nginx пытается повторно использовать сеансы ssl для https upstream; но когда HAProxy циклично обрабатывает tcp-соединения между разными бэкендами, сеанс ssl не будет действителен с одного подключения tcp к другому.

Вот и все, статья «Принцип работы handshake (рукопожатие) SSL/TLS» завершена.

Источник

Mozilla

Chapter 8
NSS and SSL Error Codes

SSL Error Codes

Table 8.1 Error codes defined in sslerr.h

Received a malformed (too long or short or invalid content) SSL handshake:

All the error codes in the following block indicate that the local socket received an improperly formatted SSL3 handshake message from the remote peer. This probably indicates a flaw in the remote peer’s implementation.

Received a malformed (too long or short) SSL record:

All the error codes in the following block indicate that the local socket received an improperly formatted SSL3 record from the remote peer. This probably indicates a flaw in the remote peer’s implementation.

Received an SSL handshake that was inappropriate for the current state:

All the error codes in the following block indicate that the local socket received an SSL3 handshake message from the remote peer at a time when it was inappropriate for the peer to have sent this message. For example, a server received a message from another server. This probably indicates a flaw in the remote peer’s implementation.

Received an SSL record that was inappropriate for the current state:

All the error codes in the following block indicate that the local socket received an SSL3 record from the remote peer at a time when it was inappropriate for the peer to have sent this message. This probably indicates a flaw in the remote peer’s implementation.

Received record/message with unknown discriminant:

All the error codes in the following block indicate that the local socket received an SSL3 record or handshake message from the remote peer that it was unable to interpret because the byte that identifies the type of record or message contained an unrecognized value. This probably indicates a flaw in the remote peer’s implementation.

Received an alert report:

All the error codes in the following block indicate that the local socket received an SSL3 or TLS alert record from the remote peer, reporting some issue that it had with an SSL record or handshake message it received. (Some _Alert codes are listed in other blocks.)

Unspecified errors that occurred while attempting some operation:

All the error codes in the following block describe the operation that was being attempted at the time of the unspecified failure. These failures may be caused by the system running out of memory, or errors returned by PKCS#11 routines that did not provide meaningful error codes of their own. These should rarely be seen. (Certain of these error codes have more specific meanings, as described.)

Constant Value Description
SSL_ERROR_EXPORT_ONLY_SERVER -12288 «Unable to communicate securely. Peer does not support high-grade encryption.»

The local system was configured to support the cipher suites permitted for domestic use. The remote system was configured to support only the cipher suites permitted for export use.
SSL_ERROR_US_ONLY_SERVER -12287 «Unable to communicate securely. Peer requires high-grade encryption which is not supported.»

The remote system was configured to support the cipher suites permitted for domestic use. The local system was configured to support only the cipher suites permitted for export use.
SSL_ERROR_NO_CYPHER_OVERLAP -12286 «Cannot communicate securely with peer: no common encryption algorithm(s).»

The local and remote systems share no cipher suites in common. This can be due to a misconfiguration at either end. It can be due to a server being misconfigured to use a non-RSA certificate with the RSA key exchange algorithm.
SSL_ERROR_NO_CERTIFICATE -12285 «Unable to find the certificate or key necessary for authentication.»

This error has many potential causes; for example:

Certificate or key not found in database.

Certificate not marked trusted in database and Certificate’s issuer not marked trusted in database.

Wrong password for key database.
SSL_ERROR_BAD_CERTIFICATE -12284 «Unable to communicate securely with peer: peers’s certificate was rejected.»

A certificate was received from the remote system and was passed to the certificate authentication callback function provided by the local application. That callback function returned SECFailure, and the bad certificate callback function either was not configured or did not choose to override the error code returned by the certificate authentication callback function.
-12283 (unused)
SSL_ERROR_BAD_CLIENT -12282 «The server has encountered bad data from the client.»

This error code should occur only on sockets that are acting as servers. It is a generic error, used when none of the other more specific error codes defined in this file applies.
SSL_ERROR_BAD_SERVER -12281 «The client has encountered bad data from the server.»

This error code should occur only on sockets that are acting as clients. It is a generic error, used when none of the other more specific error codes defined in this file applies.
SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE -12280 «Unsupported certificate type.»

The operation encountered a certificate that was not one of the well known certificate types handled by the certificate library.
SSL_ERROR_UNSUPPORTED_VERSION -12279 «Peer using unsupported version of security protocol.»

On a client socket, this means the remote server has attempted to negotiate the use of a version of SSL that is not supported by the NSS library, probably an invalid version number. On a server socket, this means the remote client has requested the use of a version of SSL older than version 2.
-12278 (unused)
-12277 «Client authentication failed: private key in key database does not correspond to public key in certificate database.»
SSL_ERROR_BAD_CERT_DOMAIN -12276 «Unable to communicate securely with peer: requested domain name does not match the server’s certificate.»

This error code should be returned by the certificate authentication callback function when it detects that the Common Name in the remote server’s certificate does not match the hostname sought by the local client, according to the matching rules specified for CERT_VerifyCertName.
-12275 (unused)
SSL_ERROR_SSL2_DISABLED -12274 «Peer only supports SSL version 2, which is locally disabled.»

The remote server has asked to use SSL version 2, and SSL version 2 is disabled in the local client’s configuration.
SSL_ERROR_BAD_MAC_READ -12273 «SSL received a record with an incorrect Message Authentication Code.»

This usually indicates that the client and server have failed to come to agreement on the set of keys used to encrypt the application data and to check message integrity. If this occurs frequently on a server, an active attack (such as the «million question» attack) may be underway against the server.
SSL_ERROR_BAD_MAC_ALERT -12272 «SSL peer reports incorrect Message Authentication Code.»

The remote system has reported that it received a message with a bad Message Authentication Code from the local system. This may indicate that an attack on that server is underway.
SSL_ERROR_BAD_CERT_ALERT -12271 «SSL peer cannot verify your certificate.»

The remote system has received a certificate from the local system, and has rejected it for some reason.
SSL_ERROR_REVOKED_CERT_ALERT -12270 «SSL peer rejected your certificate as revoked.»

The remote system has received a certificate from the local system, and has determined that the certificate has been revoked.
SSL_ERROR_EXPIRED_CERT_ALERT -12269 «SSL peer rejected your certificate as expired.»

The remote system has received a certificate from the local system, and has determined that the certificate has expired.
SSL_ERROR_SSL_DISABLED -12268 «Cannot connect: SSL is disabled.»

The local socket is configured in such a way that it cannot use any of the SSL cipher suites. Possible causes include: (a) both SSL2 and SSL3 are disabled, (b) All the individual SSL cipher suites are disabled, or (c) the socket is configured to handshake as a server, but the certificate associated with that socket is inappropriate for the Key Exchange Algorithm selected.
SSL_ERROR_FORTEZZA_PQG -12267 «Cannot connect: SSL peer is in another FORTEZZA domain.»

The local system and the remote system are in different FORTEZZA domains. They must be in the same domain to communicate.
SSL_ERROR_UNKNOWN_CIPHER_SUITE -12266 «An unknown SSL cipher suite has been requested.»

The application has attempted to configure SSL to use an unknown cipher suite.
SSL_ERROR_NO_CIPHERS_SUPPORTED -12265 «No cipher suites are present and enabled in this program.»

Possible causes: (a) all cipher suites have been configured to be disabled, (b) the only cipher suites that are configured to be enabled are those that are disallowed by cipher export policy, (c) the socket is configured to handshake as a server, but the certificate associated with that socket is inappropriate for the Key Exchange Algorithm selected.
SSL_ERROR_BAD_BLOCK_PADDING -12264 «SSL received a record with bad block padding.»

SSL was using a Block cipher, and the last block in an SSL record had incorrect padding information in it. This usually indicates that the client and server have failed to come to agreement on the set of keys used to encrypt the application data and to check message integrity. If this occurs frequently on a server, an active attack (such as the «million question» attack) may be underway against the server.
SSL_ERROR_RX_RECORD_TOO_LONG -12263 «SSL received a record that exceeded the maximum permissible length.»

This generally indicates that the remote peer system has a flawed implementation of SSL, and is violating the SSL specification.
SSL_ERROR_TX_RECORD_TOO_LONG -12262 «SSL attempted to send a record that exceeded the maximum permissible length.»

This error should never occur. If it does, it indicates a flaw in the NSS SSL library.
SSL_ERROR_CLOSE_NOTIFY_ALERT -12230 «SSL peer has closed this connection.»

The local socket received an SSL3 alert record from the remote peer, reporting that the remote peer has chosen to end the connection. The receipt of this alert is an error only if it occurs while a handshake is in progress.
SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED -12210 «SSL Server attempted to use domestic-grade public key with export cipher suite.»

On a client socket, this error reports that the remote server has failed to perform an «SSL Step down» for an export cipher. It has sent a certificate bearing a domestic-grade public key, but has not sent a ServerKeyExchange message containing an export-grade public key for the key exchange algorithm. Such a connection cannot be permitted without violating U.S. export policies. On a server socket, this indicates a failure of the local library.
SSL_ERROR_NO_SERVER_KEY_FOR_ALG -12206 «Server has no key for the attempted key exchange algorithm.»

An SSL client has requested an SSL cipher suite that uses a Key Exchange Algorithm for which the local server has no appropriate public key. This indicates a configuration error on the local server.
SSL_ERROR_TOKEN_INSERTION_REMOVAL -12205 «PKCS #11 token was inserted or removed while operation was in progress.»

A cryptographic operation required to complete the handshake failed because the token that was performing it was removed while the handshake was underway. Another token may also have been inserted into the same slot.
SSL_ERROR_TOKEN_SLOT_NOT_FOUND -12204 «No PKCS#11 token could be found to do a required operation.»

A cryptographic operation required a PKCS#11 token with specific abilities, and no token could be found in any slot, including the «soft token» in the internal virtual slot, that could do the job. May indicate a server configuration error, such as having a certificate that is inappropriate for the Key Exchange Algorithm selected.
-12203 «Cannot communicate securely with peer: no common compression algorithm(s).»
-12202 «Cannot initiate another SSL handshake until current handshake is complete.»
-12201 «Received incorrect handshakes hash values from peer.»
-12200 «The certificate provided cannot be used with the selected key exchange algorithm.»
-12199 «No certificate authority is trusted for SSL client authentication.»
-12198 «Client’s SSL session ID not found in server’s session cache.»
SSL_ERROR_RX_MALFORMED_HELLO_REQUEST -12261 «SSL received a malformed Hello Request handshake message.»
SSL_ERROR_RX_MALFORMED_CLIENT_HELLO -12260 «SSL received a malformed Client Hello handshake message.»
SSL_ERROR_RX_MALFORMED_SERVER_HELLO -12259 «SSL received a malformed Server Hello handshake message.»
SSL_ERROR_RX_MALFORMED_CERTIFICATE -12258 «SSL received a malformed Certificate handshake message.»
SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH -12257 «SSL received a malformed Server Key Exchange handshake message.»
SSL_ERROR_RX_MALFORMED_CERT_REQUEST -12256 «SSL received a malformed Certificate Request handshake message.»
SSL_ERROR_RX_MALFORMED_HELLO_DONE -12255 «SSL received a malformed Server Hello Done handshake message.»
SSL_ERROR_RX_MALFORMED_CERT_VERIFY -12254 «SSL received a malformed Certificate Verify handshake message.»
SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH -12253 «SSL received a malformed Client Key Exchange handshake message.»
SSL_ERROR_RX_MALFORMED_FINISHED -12252 «SSL received a malformed Finished handshake message.»
SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER -12251 «SSL received a malformed Change Cipher Spec record.»
SSL_ERROR_RX_MALFORMED_ALERT -12250 «SSL received a malformed Alert record.»
SSL_ERROR_RX_MALFORMED_HANDSHAKE -12249 «SSL received a malformed Handshake record.»
SSL_ERROR_RX_MALFORMED_APPLICATION_DATA -12248 «SSL received a malformed Application Data record.»
SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST -12247 «SSL received an unexpected Hello Request handshake message.»
SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO -12246 «SSL received an unexpected Client Hello handshake message.»
SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO -12245 «SSL received an unexpected Server Hello handshake message.»
SSL_ERROR_RX_UNEXPECTED_CERTIFICATE -12244 «SSL received an unexpected Certificate handshake message.»
SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH -12243 «SSL received an unexpected Server Key Exchange handshake message.»
SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST -12242 «SSL received an unexpected Certificate Request handshake message.»
SSL_ERROR_RX_UNEXPECTED_HELLO_DONE -12241 «SSL received an unexpected Server Hello Done handshake message.»
SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY -12240 «SSL received an unexpected Certificate Verify handshake message.»
SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH -12239 «SSL received an unexpected Client Key Exchange handshake message.»
SSL_ERROR_RX_UNEXPECTED_FINISHED -12238 «SSL received an unexpected Finished handshake message.»
SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER -12237 «SSL received an unexpected Change Cipher Spec record.»
SSL_ERROR_RX_UNEXPECTED_ALERT -12236 «SSL received an unexpected Alert record.»
SSL_ERROR_RX_UNEXPECTED_HANDSHAKE -12235 «SSL received an unexpected Handshake record.»
SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA -12234 «SSL received an unexpected Application Data record.»
SSL_ERROR_RX_UNKNOWN_RECORD_TYPE -12233 «SSL received a record with an unknown content type.»
SSL_ERROR_RX_UNKNOWN_HANDSHAKE -12232 «SSL received a handshake message with an unknown message type.»
SSL_ERROR_RX_UNKNOWN_ALERT -12231 «SSL received an alert record with an unknown alert description.»
SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT -12229 «SSL peer was not expecting a handshake message it received.»
SSL_ERROR_DECOMPRESSION_FAILURE_ALERT -12228 «SSL peer was unable to successfully decompress an SSL record it received.»
SSL_ERROR_HANDSHAKE_FAILURE_ALERT -12227 «SSL peer was unable to negotiate an acceptable set of security parameters.»
SSL_ERROR_ILLEGAL_PARAMETER_ALERT -12226 «SSL peer rejected a handshake message for unacceptable content.»
SSL_ERROR_UNSUPPORTED_CERT_ALERT -12225 «SSL peer does not support certificates of the type it received.»
SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT -12224 «SSL peer had some unspecified issue with the certificate it received.»
SSL_ERROR_DECRYPTION_FAILED_ALERT -12197 «Peer was unable to decrypt an SSL record it received.»
SSL_ERROR_RECORD_OVERFLOW_ALERT -12196 «Peer received an SSL record that was longer than is permitted.»
SSL_ERROR_UNKNOWN_CA_ALERT -12195 «Peer does not recognize and trust the CA that issued your certificate.»
SSL_ERROR_ACCESS_DENIED_ALERT -12194 «Peer received a valid certificate, but access was denied.»
SSL_ERROR_DECODE_ERROR_ALERT -12193 «Peer could not decode an SSL handshake message.»
SSL_ERROR_DECRYPT_ERROR_ALERT -12192 «Peer reports failure of signature verification or key exchange.»
SSL_ERROR_EXPORT_RESTRICTION_ALERT -12191 «Peer reports negotiation not in compliance with export regulations.»
SSL_ERROR_PROTOCOL_VERSION_ALERT -12190 «Peer reports incompatible or unsupported protocol version.»
SSL_ERROR_INSUFFICIENT_SECURITY_ALERT -12189 «Server requires ciphers more secure than those supported by client.»
SSL_ERROR_INTERNAL_ERROR_ALERT -12188 «Peer reports it experienced an internal error.»
SSL_ERROR_USER_CANCELED_ALERT -12187 «Peer user canceled handshake.»
-12186 «Peer does not permit renegotiation of SSL security parameters.»
SSL_ERROR_GENERATE_RANDOM_FAILURE -12223 «SSL experienced a failure of its random number generator.»
SSL_ERROR_SIGN_HASHES_FAILURE -12222 «Unable to digitally sign data required to verify your certificate.»
SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE -12221 «SSL was unable to extract the public key from the peer’s certificate.»
SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE -12220 «Unspecified failure while processing SSL Server Key Exchange handshake.»
SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE -12219 «Unspecified failure while processing SSL Client Key Exchange handshake.»
SSL_ERROR_ENCRYPTION_FAILURE -12218 «Bulk data encryption algorithm failed in selected cipher suite.»
SSL_ERROR_DECRYPTION_FAILURE -12217 «Bulk data decryption algorithm failed in selected cipher suite.»
SSL_ERROR_MD5_DIGEST_FAILURE -12215 «MD5 digest function failed.»
SSL_ERROR_SHA_DIGEST_FAILURE -12214 «SHA-1 digest function failed.»
SSL_ERROR_MAC_COMPUTATION_FAILURE -12213 «Message Authentication Code computation failed.»
SSL_ERROR_SYM_KEY_CONTEXT_FAILURE -12212 «Failure to create Symmetric Key context.»
SSL_ERROR_SYM_KEY_UNWRAP_FAILURE -12211 «Failure to unwrap the Symmetric key in Client Key Exchange message.»
SSL_ERROR_IV_PARAM_FAILURE -12209 «PKCS11 code failed to translate an IV into a param.»
SSL_ERROR_INIT_CIPHER_SUITE_FAILURE -12208 «Failed to initialize the selected cipher suite.»
SSL_ERROR_SOCKET_WRITE_FAILURE -12216 «Attempt to write encrypted data to underlying socket failed.»

After the data to be sent was encrypted, the attempt to send it out the socket failed. Likely causes include that the peer has closed the connection.
SSL_ERROR_SESSION_KEY_GEN_FAILURE -12207 «Failed to generate session keys for SSL session.»

On a client socket, indicates a failure of the PKCS11 key generation function. On a server socket, indicates a failure of one of the following: (a) to unwrap the pre-master secret from the ClientKeyExchange message, (b) to derive the master secret from the premaster secret, (c) to derive the MAC secrets, cryptographic keys, and initialization vectors from the master secret. If encountered repeatedly on a server socket, this can indicate that the server is actively under a «million question» attack.

SEC Error Codes

Table 8.2 Security error codes defined in secerr.h

Constant Value Description
-8192 An I/O error occurred during authentication; or
an error occurred during crypto operation (other than signature verification).
-8191 Security library failure.
-8190 Security library: received bad data.
-8189 Security library: output length error.
-8188 Security library: input length error.
-8187 Security library: invalid arguments.
-8186 Security library: invalid algorithm.
-8185 Security library: invalid AVA.
-8184 Security library: invalid time.
-8183 Security library: improperly formatted DER-encoded message.
-8182 Peer’s certificate has an invalid signature.
-8181 Peer’s certificate has expired.
-8180 Peer’s certificate has been revoked.
-8179 Peer’s certificate issuer is not recognized.
-8178 Peer’s public key is invalid
-8177 The password entered is incorrect.
-8176 New password entered incorrectly.
-8175 Security library: no nodelock.
-8174 Security library: bad database.
-8173 Security library: memory allocation failure.
-8172 Peer’s certificate issuer has been marked as not trusted by the user.
-8171 Peer’s certificate has been marked as not trusted by the user.
-8170 Certificate already exists in your database.
-8169 Downloaded certificate’s name duplicates one already in your database.
-8168 Error adding certificate to database.
-8167 Error refiling the key for this certificate.
-8166 The private key for this certificate cannot be found in key database.
-8165 This certificate is valid.
-8164 This certificate is not valid.
-8163 Certificate library: no response.
-8162 The certificate issuer’s certificate has expired.
-8161 The CRL for the certificate’s issuer has expired.
-8160 The CRL for the certificate’s issuer has an invalid signature.
-8159 New CRL has an invalid format.
-8158 Certificate extension value is invalid.
-8157 Certificate extension not found.
-8156 Issuer certificate is invalid.
-8155 Certificate path length constraint is invalid.
-8154 Certificate usages field is invalid.
-8153 Internal-only module.
-8152 The key does not support the requested operation.
-8151 Certificate contains unknown critical extension.
-8150 New CRL is not later than the current one.
-8149 Not encrypted or signed: you do not yet have an email certificate.
-8148 Not encrypted: you do not have certificates for each of the recipients.
-8147 Cannot decrypt: you are not a recipient, or matching certificate and private key not found.
-8146 Cannot decrypt: key encryption algorithm does not match your certificate.
-8145 Signature verification failed: no signer found, too many signers found,

or improper or corrupted data.

Last Updated: 04/11/03 18:46:49 PDT

Portions of this content are © 1998–2009 by individual mozilla.org contributors; content available under a Creative Commons license | Details.

Last modified May 15, 2006 Document History

Источник

READ  Ruby setup rb error
Источник
HOW TO FIX THE SSL/TLS HANDSHAKE FAILED ERROR? — ABOUT SSL

how-to-fix-the-ssltls-handshake-failed-error-about-ssl image


From aboutssl.org
Estimated Reading Time 8 mins

  • Protocol Mismatch. It’s one of the errors which can happen due to both the server-side or the client-side, and generally, it’s not worth solving depending upon the circumstance.
  • Cipher Suite Mismatch. A cipher suite is quite similar to the Protocol Mismatch. SSL/TLS isn’t just a single algorithm that handles everything on its own but a combination of numerous algorithms that serves different functions and work with each other to make up SSL/TLS.
  • Incorrect SSL/TLS Certificate. Many different reasons can make a browser view at an SSL/TLS Certificate as incorrect while preventing it from the successful handshake.
  • The hostname is Not Correct. Previously there was a problem with non-WWW and WWW versions of the websites, but it has been reduced radically by the Certificate Authority community allowing one of them to be listed as a SAN free of cost.
  • Certificate Chain is Not Correct. The SSL/TLS and PKI trust model generally relies on root programs, which are the collections of trusted CA root certificates that are stored onto your computer system.
  • Revoked/Expired Certificates. Currently, the maximum validity of an SSL/TLS certificate is of 2 years and three months extra (Total 27 months because CAs allow carrying up three months over from previously installed certificate.)
  • Self-Signed Replacements. If you’ve installed a self-signed SSL/TLS certificate on your website and its live on the public internet, then it will generate an error.
  • SNI-Enabled Servers. Generally, it’s an internal issue that happens between devices, but sometimes there are chances of getting an SSL/TLS handshake failed error if a client communicating with a Server Named Indication (SNI) enabled server is not SNI enabled.
HOW TO FIX “SSL HANDSHAKE FAILED” & «CLOUDFLARE 525» ERROR

how-to-fix-ssl-handshake-failed-cloudflare-525-error image


From kinsta.com
Reviews 4
Published 2020-06-01
Estimated Reading Time 8 mins

  • Update Your System Date and Time. Let’s start with one of the more unlikely causes, but one that is incredibly easy to correct if it is the problem: your computer’s clock.
  • Check to See If Your SSL Certificate Is Valid. Expiration dates are placed on SSL certificates, to help make sure their validation information remains accurate.
  • Configure Your Browser for the Latest SSL/TLS Protocol Support. Sometimes the best way to determine the root cause of an issue is by process of elimination.
  • Verify That Your Server Is Properly Configured to Support SNI. It’s also possible that the SSL handshake failure is being caused by improper Server Name Indication (SNI) configuration.
  • Make Sure the Cipher Suites Match. If you still haven’t been able to identify the cause of the SSL handshake failure, it might be due to a cipher suite mismatch.
SSL HANDSHAKE FAILURES — BAELDUNG


From baeldung.com
Estimated Reading Time 8 mins

SSL HANDSHAKE FAILED ERROR — HOW TO SOLVE THIS ERROR?

It’s always better to understand why the SSL Handshake Failure occurs. The thanks to solving a drag know its in-depth biography. As we all know on certificate delivery the PC gets stimulated for key generation. The public key’s used and encryption comes within the league. The failure occurs when read access has not been permitted to the OS. As a result authentication …
From comparecheapssl.com
Estimated Reading Time 6 mins

JAVA 11 AND 12 SSL SOCKETS FAIL ON A HANDSHAKE_FAILURE …

Here is the solution: one needs the -keyalg flag with keytool to generate certificates, otherwise, the key will be ciphered with the old default DSA, that is not allowed anymore with TLS1.3. With RSA it works. Since Java 11, TLS1.3 is the new default encryption scheme for SSL sockets in JSSE, when it can be negotiated.
From stackoverflow.com
Reviews 6

SSL — SOLVING SSLV3 ALERT HANDSHAKE FAILURE WHEN TRYING TO …

Fails with: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure. What am I doing wrong in this process? It works when I try with a received a test certificate including a private key from the service (self signed certificate). But when I use a certificate they generated from my CSR and then use my private key as key, it …
From stackoverflow.com

SSL HANDSHAKE FAILED ERROR — ULTIMATE GUIDE BY EXPERTS

“SSL Handshake Error” is a message you receive when the SSL handshake process fails. After you send the secure connection request to the web browser, the browser is supposed to send a public key to your computer that’s automatically checked against a list of certificate authorities.
From rapidsslonline.com

POSTFIX TLS: HANDSHAKE FAILURE — SERVER FAULT

Reset to default. Highest score (default) Date modified (newest first) Date created (oldest first) This answer is useful. 1. This answer is not useful. Show activity on this post. You likely have this in your main.cf configuration: smtpd_use_tls …
From serverfault.com

TESTING SSL FROM NETSCALER–ISSUES WITH SSL HANDSHAKE …

Testing SSL from Netscaler–Issues with SSL handshake From time to time we need to setup load balancing to a SSL based service or when setting up connection to a secure Storefront (which is the default) there is one thing that alot of people are missing from the config when setting up, which results in wierd issues or getting SSL handshake errors from the …
From msandbu.wordpress.com

JAVA EXCEPTION HANDLING — SSLHANDSHAKEEXCEPTION — …

As it happens, SSL (Secure Socket Layer) in general has since been “replaced” with the newer protocol known as TLS (Transport Layer Security). Regardless, many modern code bases, languages, documents, and articles (including this one) continue to refer to this protocol as SSL, since both terms are commonly used interchangeably.
From airbrake.io

CRYPTOGRAPHY — SSL HANDSHAKE FAILURE MODES — INFORMATION …

There is a mode flag, called SSL_VERIFY_PEER which when set on the server, it will ask for a client certificate at the handshake. The client is free to send it or not. Server mode: if the client did not return a certificate, the TLS/SSL handshake is immediately terminated with a «handshake failure» alert.
From security.stackexchange.com

SSL HANDSHAKE FAILURES DUE TO … — CLOUDBEES SUPPORT

SSL Client is Jenkins If the client is Jenkins — for example the issue a Jenkins master not able to connect to CJOC or another service — you can run the following groovy script under Manage Jenkins > Script Console to display the list of cipher suites:
From support.cloudbees.com

TROUBLESHOOT APACHE SSL CERTIFICATE PROBLEMS | DIGICERT.COM

«SSL3_READ_BYTES:sslv3 alert handshake failure» and «SSL23_WRITE:ssl handshake failure» Errors. These errors are caused by a directive in the configuration file that requires mutual authentication. For example, if an SSL Certificate is sent from the server and then a separate SSL Certificate is sent back from the client during the SSL handshake …
From digicert.com

SQL SERVER — SQL — AN ERROR OCCURRED DURING THE PRE-LOGIN …

This problem can be related to a firewall in the middle that is doing SSL inspection. I Suggest you either try again using another connection not doing SSL inspection, or ask your firewall admin to create an exemption for the source and/or destination you are connecting to, Cheers! Share . Improve this answer. Follow answered Aug 29, 2019 at 16:06. Fernando Cabal Fernando …
From serverfault.com

WHAT DOES SSL CONNECTION ERROR MEAN AND HOW TO FIX IT

What Is A SSL Certificate? An SSL Certificate is a method of ensuring the user that the information sent over a website is safe and encrypted. SSL certificates contain information about the domain of the website, the owner’s address and other relevant information.
From host.ie

SSL HANDSHAKE FAILS AFTER CHANGING WEBLOGIC SERVERS SSL …

The SSL Implementation in WLS has changed from Certicom to JSSE. After this change the handshake between OHS and WLS no longer is successful. -Before 10.3.3 (11g), Certicom SSL was the only SSL implementation. -In 10.3.3 thru 10.3.6 (11g), Certicom SSL is the default SSL implementation, with JSSE available by enabling a property switch.
From support.oracle.com

[SOLVED] TLS 1.2 — SSLHANDSHAKEEXCEPTION: REMOTE HOST …

I have already posted code fix to bypass SSL matching in earlier post. Unfortunately, that fix works in TLS and TLS 1.1 protocols. It doesn’t work in TLS 1.2 protocol.
From howtodoinjava.com

TROUBLESHOOTING TLS / SSL COMMUNICATION PROBLEMS WHEN …

Apr 23 2019 10:26 AM. This is the second part of our series of articles about troubleshooting TLS / SSL communications problems when you make Http Web Request or WCF queries from your ASP.NET applications to SSL endpoints. In our first scenario, we troubleshooted a «The underlying connection was closed: Could not establish trust relationship …
From techcommunity.microsoft.com

SSL_ERROR_HANDSHAKE_FAILURE_ALERT | FIREFOX SUPPORT FORUM …

Explore Our Help Articles. Dig into the knowledge base, tips and tricks, troubleshooting, and so much more. Firefox Browser; Mozilla VPN
From support.mozilla.org

SSL — A LOT OF «SSL_DO_HANDSHAKE() FAILED (SSL: ERROR …

SSL A lot of «SSL_do_handshake() failed (SSL: error» Discussion in ‘ Nginx, PHP-FPM & MariaDB MySQL ‘ started by rdan , Apr 4, 2017 . Previous Thread Next Thread
From community.centminmod.com

[NMS-13325] SSL/TLS HANDSHAKE FAILURE — THE OPENNMS ISSUE …

Linked Applications. Loading… Dashboards
From issues.opennms.org

SSL HANDSHAKE FAILED ERROR: WHAT IT IS AND HOW TO … — DZONE

Sometimes the client, and therefore, the server cannot establish the connection via the protocol. That’s when an SSL handshake failure occurs. This …
From dzone.com

2389482 — ERROR «SSSLERR_SSL_READ» SHOWS UP DURING …

SSSLERR_SSL_READ «received a fatal TLS handshake failure alert message from the peer» , KBA , ca-gtf-csc-edo-in-iv , einvoice , BC-SEC-SSL , Secure Sockets Layer Protocol , Problem . About this page This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP ONE Support launchpad (Login required).
From apps.support.sap.com

TLS/SSL HANDSHAKE FAILURES | APIGEE EDGE | APIGEE DOCS

This is the cause for the TLS/SSL handshake failure and the reason that the backend server sends the Fatal Alert: Handshake Failure to the Message Processor. Verify that the jsse.enableSNIExtension property in system.properties is set to false on the Message Processor to confirm that the Message Processor is not enabled to communicate with the SNI …
From docs.apigee.com

SOLVED: SSLV3 ALERT HANDSHAKE FAILURE — ATLASSIAN COMMUNITY

That worked, thanks! I used system Git, which was v 1.x, and switching to Embedded Git, which is 2.x, and updating it helped. It looks like Atlassian changed something in Bit Bucket over the weekend, and it rendered it incompatible with the old Git versions.
From community.atlassian.com

TROUBLESHOOTING SSL RELATED ISSUES (SERVER CERTIFICATE …

The Hash value seen above is the Thumbprint of your SSL certificate. Notice, that the Guid is all zero in a non-working scenario. You may see the Hash either having some value or blank. Even if we remove the certificate from the web site, and then run «httpcfg query ssl», the website will still list Guid as all 0’s. If you see the GUID as «{0000…..000}, then there is a …
From docs.microsoft.com

SSL HANDSHAKE ERROR WITH WINDOWS SERVER 2008 R2

(provider: SSL Provider, error: 0 — The wait operation timed out.) (.Net SqlClient Data Provider). Server is getting hanged and we are unable to connect the server. Request any one can revert on this. Regards, Sudhanshu Thakur . Sudhanshu Thakur. Monday, May 23, 2016 10:50 AM. Answers text/html 5/24/2016 7:45:26 AM Jay Gu 0. 0. Sign in to vote. Hi …
From social.technet.microsoft.com

SSLV3 ALERT HANDSHAKE FAILURE — GENERAL — RSTUDIO COMMUNITY

sslv3 alert handshake failure. The following code has been working nicely from both desktop Win10 and Ubuntu PC. It still works in Ubuntu (R 3.2.3, in daily use) but now fails in Win10 (R 3.4.4, last successful run maybe 6 — 8 months ago): Since last successful run I use another Win10 PC, but tried it with my laptop (Win10, where it used to …
From community.rstudio.com

SSLV3 ALERT HANDSHAKE ERROR — ATLASSIAN COMMUNITY

This morning I «stumbled» into the same problem, that i couldn’t connect to our repository due to that damn SSL handshake failure. A quick internet search has led me to this page, but I was glad to fix the issue as it also occurred after re-installing Sourcetree and trying to connect to our repository via the terminal. I installed a more recent version of GIT (2.14.1) and …
From community.atlassian.com

FAILURE ON SSL HANDSHAKE TYPE · ISSUE #568 · REST-CLIENT …

Attempting to connect to an API with key verification — failure output during attempt: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/ruby/2.0.0/net …
From github.com

¿CóMO ARREGLAR EL ERROR DE «SSL HANDSHAKE FAILED»? (5 MéTODOS)

3. Configura tu navegador para el último soporte de protocolo SSL/TLS. A veces la mejor manera de determinar la causa fundamental de un problema es mediante el proceso de eliminación. Como mencionamos anteriormente, el SSL Handshake Failed puede ocurrir a menudo debido a una mala configuración del navegador.
From kinsta.com

解决JAVAX.NET.SSL.SSLHANDSHAKEEXCEPTION: RECEIVED FATAL …

解决javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 背景 . 今天尝试用Java去访问一个https接口，但抛出下面的异常： javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 解决过程. 遇到问题首先去Google，然后在 javax.net.ssl.SSLException: Received fatal alert: protocol_version 找到了问题原因 …
From jianshu.com

SOLVED: MCAFEE ENTERPRISE SUPPORT COMMUNITY — SSLV3 …

MWG7.4 response: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure We found sollution by modifying «Server Cipher list» in «Enable SSL Scanner» settings. Original value: ALL:!ADH:!kEDH:+RC4:@STRENGTH
From community.mcafee.com

SSL HANDSHAKE FAILURE — CISCO COMMUNITY

SSL handshake failure Hi all, am triing to implement Lets Encrypt certificate enrollment for Cisco ASA — I am using guide. so I configured all fof the required things but finaly I stuck on SSL handsake failure on ASA. Small descryption: in process of cerificate enrolment the selfsigned certificate with proper attributes is generated by the script and uploaded to ASA — …
From community.cisco.com

SSL HANDSHAKE FAILURE WHEN WAS APPLICATION TRIES TO ACCESS …

Updated 1/11/2022 IBM is actively responding to the reported remote code execution vulnerability in the Apache Log4j 2 Java library dubbed Log4Shell (or LogJam).We are investigating and taking action for IBM as an enterprise, IBM products and IBM services that may be potentially impacted, and will continually publish information to help customers detect, …
From ibm.com

SSL — SSLV3 ALERT HANDSHAKE FAILURE – ERROR FROM …

I’ve been using a Python script (2.7.6 on Ubuntu 14.04LTS) to pick entries from RSS feeds using the «feedparser» module. This week it stopped working with a particular site. Digging, feedparser…
From unix.stackexchange.com

SOAP UI — ERROR:EXCEPTION IN REQUEST: JAVAX.NET.SSL …

Solution- upgrade to SoapUI 5.5.0 (which is the current latest version as of March 2019) fixed both issues. Choose option to upgrade the current SoapUI version. If you are upgrading the current version it will install new vmoptions file. (the first issue of ssl handshake is also fixed in 5.5.0, no need of adding parameters for TLS in vmoptions …
From stackoverflow.com

READHANDSHAKERECORD; NESTED EXCEPTION IS JAVAX.NET.SSL …

readHandshakeRecord; nested exception is javax.net.ssl.SSLException: readHandshakeRecord when calling Rest API
From johnnn.tech

GOOGLE DATAFLOW : JAVAX.NET.SSL.SSLHANDSHAKEEXCEPTION …

I have a dataflow that does a request to an API to retrieve some data. Recently there was an update on the ciphers in the API and the dataflow suddenly started failing. I was…
From johnnn.tech

2512832 — SSL HANDSHAKE WITH SERVICEPOINT.SAP.COM:443 …

2512832-SSL handshake with servicepoint.sap.com:443 failed: SSSLERR_EWOULDBLOCK (-71) Symptom. intermediate connection issues trying to reach servicepoint.sap.com via saprouter. HUB connection works instable. Read more… Environment. Solution Manager 7.2. Product. SAP Solution Manager 7.2 Keywords. KBA , XX-SER-NET-HTL , Problems with remote access …
From apps.support.sap.com

NSS AND SSL ERROR CODES — MOZILLA

SSL_ERROR_IV_PARAM_FAILURE-12209 «PKCS11 code failed to translate an IV into a param.» SSL_ERROR_INIT_CIPHER_SUITE_FAILURE-12208 «Failed to initialize the selected cipher suite.» SSL_ERROR_SOCKET_WRITE_FAILURE-12216 «Attempt to write encrypted data to underlying socket failed.» After the data to be sent was encrypted, the attempt to send it out …
From www-archive.mozilla.org

SAP SSL HANDSHAKE FAILED | SAP COMMUNITY

SAP SSL handshake failed. 41621 Views Last edit Apr 12, 2018 at 03:06 PM 3 rev. Follow RSS Feed I’m trying to retrieve data from an open data api. I have downloaded the certificate from the site and imported it into STRUST (SSL Client Anonymous). Then I created a HTTP connection to external server in SM59. In the beginning it worked fine, until last week …
From answers.sap.com

SSL HANDSHAKE FAILURES — BAD CLIENT CERTIFICATE | APIGEE …

This causes the SSL handshake to fail and backend server sends «Fatal alert: bad_certificate» message. Resolution Ensure the certificate with the issuer/Certificate Authority that matches the issuer/Certificate Authority of the Client’s Leaf Certificate (first certificate in the chain) is stored in the backend server’s Truststore.
From docs.apigee.com

ISSUE — TLS: SSL_READ FAILED: ERROR:14094412:SSL ROUTINES …

it seems to be an invalid SSL-Cert. i have changed the PTR DNS Record to a lokal domain not the default servername by the hoster Server4you. Than i changed the serverpool certs to lets encrypt with a new domain mail.luvotec.de for example.
From talk.plesk.com

JON SCHNEIDER’S TECH BLOG: FIX: SSL HANDSHAKING ERROR IN …

Jonathan: Thanks for this exceptionally helpful article. For those who might not be able to install «Microsoft Message Analyzer,» you could also investigate this problem in a more primitive way by enabling System.Net tracing for your .NET program (1) to see the SSL handshake, then manually analyzing the ClientHello packet (2) to find the client’s proposed …
From blog.jonschneider.com

JDK11 SUPPORT: FETCHHTTPTEST: SSL HANDSHAKE_FAILURE …

Tests run: 30, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 12.543 sec &lt;&lt;&lt; FAILURE! testSslTrustLevel(org.archive.modules.fetcher.FetchHTTPTests) Time …
From github.com

CHARLES 抓包 CLIENT SSL HANDSHAKE FAILED — REMOTE HOST …

Charles 抓包 Client SSL handshake failed — Remote host closed connection during handshake. Charles 抓包 https 报错： Client SSL handshake failed — Remote host closed connection during handshake. 解决方案记录下： TRUSTING CUSTOM ROOT CERTIFICATES. 吐槽：国内的同行们，就不要再copy国外的文章了，真的是浪费存储空间呀. 推荐阅读 更多精彩内容 …
From jianshu.com

SSL HANDSHAKE FAILURE — WEBMETHODS — SOFTWARE AG TECH …

Dear all, I’m facing a problem to access an https client webservice. I’m using webMethods integration server 9.0.1 on a windows env. I tried different debug options but the result remain the same. This is the wrapper.log ssl debug snap: ssl_debug(2): Starting handshake (iSaSiLk 3.03)… ssl_debug(2): Remote client:1*.1*.2*.***:443, Timestamp:Tue …
From tech.forums.softwareag.com

Источник

I am configuring OpenVPN 2.3.6-1 on my Arch Linux server in order to encrypt SMB traffic over the public Internet. When I test the setup on one of my Linux virtual machine clients, I get the error: TLS Error: TLS handshake failed.

I quickly read (OpenVPN on OpenVZ TLS Error: TLS handshake failed (google suggested solutions not helping)) and tried to switch from the default UDP to TCP, but that only caused the client to repeatedly report that the connection timed out. I also tried disabling the cipher and TLS authentication, but that caused the server to fail with Assertion failed at crypto_openssl.c:523. In both instances, the required changes were made to both the client and server configurations.

I have been following the instructions at (https://wiki.archlinux.org/index.php/OpenVPN) to set up OpenVPN and the instructions at (https://wiki.archlinux.org/index.php/Create_a_Public_Key_Infrastructure_Using_the_easy-rsa_Scripts) to create the keys and certificates. The only deviations I have made from these instructions have been specifying my own computers’ names and their corresponding key/certificate file names.

See also my original question about securing SMB traffic over the Internet: (Simple encryption for Samba shares)

Can anybody explain how I can solve this issue?

Details:

Server: Arch Linux (up to date) connected directly to gateway via ethernet cable. No iptables.

Client: Arch Linux (up to date) virtual machine on VirtualBox 4.3.28r100309 Windows 8.1 host, bridged network adapter. No iptables. Windows Firewall disabled.

Gateway: Port forwarding for port 1194 enabled, no firewall restrictions.

Here are the configuration files on the server and client, respectively. I created these according to the instructions on the Arch Wiki.

/etc/openvpn/server.conf (Non-comment lines only):

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server-name.crt
key /etc/openvpn/server-name.key
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

/etc/openvpn/client.conf (Non-comment lines only):

client
dev tun
proto udp
remote [my public IP here] 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client-name.crt
key /etc/openvpn/client-name.key
remote-cert-tls server
tls-auth /etc/openvpn/ta.key 1
comp-lzo
verb 3

Here are the outputs of running openvpn on the machines with the above configurations. I started the server first, then the client.

The output of openvpn /etc/openvpn/server.conf on the server:

Thu Jul 30 17:02:53 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec  2 2014
Thu Jul 30 17:02:53 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09
Thu Jul 30 17:02:53 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Jul 30 17:02:53 2015 Diffie-Hellman initialized with 2048 bit key
Thu Jul 30 17:02:53 2015 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Thu Jul 30 17:02:53 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 30 17:02:53 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 30 17:02:53 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Jul 30 17:02:53 2015 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=enp5s0 HWADDR=##:##:##:##:##:##
Thu Jul 30 17:02:53 2015 TUN/TAP device tun0 opened
Thu Jul 30 17:02:53 2015 TUN/TAP TX queue length set to 100
Thu Jul 30 17:02:53 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jul 30 17:02:53 2015 /usr/bin/ip link set dev tun0 up mtu 1500
Thu Jul 30 17:02:53 2015 /usr/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Thu Jul 30 17:02:53 2015 /usr/bin/ip route add 10.8.0.0/24 via 10.8.0.2
Thu Jul 30 17:02:53 2015 GID set to nobody
Thu Jul 30 17:02:53 2015 UID set to nobody
Thu Jul 30 17:02:53 2015 UDPv4 link local (bound): [undef]
Thu Jul 30 17:02:53 2015 UDPv4 link remote: [undef]
Thu Jul 30 17:02:53 2015 MULTI: multi_init called, r=256 v=256
Thu Jul 30 17:02:53 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Jul 30 17:02:53 2015 IFCONFIG POOL LIST
Thu Jul 30 17:02:53 2015 Initialization Sequence Completed

The output of openvpn /etc/openvpn/client.conf on the client:

Thu Jul 30 21:03:02 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec  2 2014
Thu Jul 30 21:03:02 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09
Thu Jul 30 21:03:02 2015 WARNING: file '/etc/openvpn/client-name.key' is group or others accessible
Thu Jul 30 21:03:02 2015 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Thu Jul 30 21:03:02 2015 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Thu Jul 30 21:03:02 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 30 21:03:02 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 30 21:03:02 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Jul 30 21:03:02 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Jul 30 21:03:02 2015 UDPv4 link local: [undef]
Thu Jul 30 21:03:02 2015 UDPv4 link remote: [AF_INET][my public IP here]:1194
Thu Jul 30 21:04:02 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Jul 30 21:04:02 2015 TLS Error: TLS handshake failed
Thu Jul 30 21:04:02 2015 SIGUSR1[soft,tls-error] received, process restarting
Thu Jul 30 21:04:02 2015 Restart pause, 2 second(s)

Источник

0 0 голоса
Рейтинг статьи
Подписаться
Уведомить о
guest

0 комментариев
Старые
Новые Популярные
Межтекстовые Отзывы
Посмотреть все комментарии

А вот еще интересные материалы:

  • Яшка сломя голову остановился исправьте ошибки
  • Ясность цели позволяет целеустремленно добиваться намеченного исправьте ошибки
  • Ясность цели позволяет целеустремленно добиваться намеченного где ошибка
  • Rdp ошибка проверки подлинности 0x80004005
  • React сообщение об ошибке

    • ➤