文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
首页
学习
活动
专区
圈层
工具
MCP广场
返回腾讯云官网
社区首页 >问答首页 >OpenVPN: TLS错误: TLS密钥协商在60秒内失败

问OpenVPN: TLS错误: TLS密钥协商在60秒内失败
EN

Server Fault用户
提问于 2009-12-08 20:34:37
回答 3查看 71.6K关注 0票数 5

http://openvpn.net/index.php/open-source/documentation/howto.html页面告诉错误是因为：“此错误表示客户端无法与服务器建立网络连接。”但我认为这里不是这样的。

下面是我的配置: OpenVPN服务器已经安装在windows 2008上，有10个有效的ip地址。我可以从外部平平OpenVPN ip地址，也没有在服务器上安装防火墙来阻塞端口。

代码语言：javascript
运行
复制
OpenVPN Server Configuration:
local 96.31.90.174
port 1937
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

OpenVPN客户端配置:我已经在没有防火墙的windows 7上安装了它。

代码语言：javascript
运行
复制
client
dev tun
proto tcp
remote 96.31.90.174 1937
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

下面是客户机日志：

代码语言：javascript
运行
复制
Tue Dec 08 23:42:06 2009 LZO compression initialized
Tue Dec 08 23:42:06 2009 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:
0 EL:0 ]
Tue Dec 08 23:42:06 2009 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:
0 EL:0 AF:3/1 ]
Tue Dec 08 23:42:06 2009 Local Options hash (VER=V4): '69109d17'
Tue Dec 08 23:42:06 2009 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Dec 08 23:42:06 2009 Attempting to establish TCP connection with 96.31.90.17
4:1937
Tue Dec 08 23:42:06 2009 TCP connection established with 96.31.90.174:1937
Tue Dec 08 23:42:06 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Dec 08 23:42:06 2009 TCPv4_CLIENT link local: [undef]
Tue Dec 08 23:42:06 2009 TCPv4_CLIENT link remote: 96.31.90.174:1937
Tue Dec 08 23:42:08 2009 TLS: Initial packet from 96.31.90.174:1937, sid=fdc04dc
5 451dd470
Tue Dec 08 23:43:06 2009 TLS Error: TLS key negotiation failed to occur within 6
0 seconds (check your network connectivity)
Tue Dec 08 23:43:06 2009 TLS Error: TLS handshake failed
Tue Dec 08 23:43:06 2009 Fatal TLS error (check_tls_errors_co), restarting
Tue Dec 08 23:43:06 2009 TCP/UDP: Closing socket
Tue Dec 08 23:43:06 2009 SIGUSR1[soft,tls-error] received, process restarting
Tue Dec 08 23:43:06 2009 Restart pause, 5 second(s)

以下是服务器日志：

代码语言：javascript
运行
复制
Tue Dec 08 15:26:13 2009 ROUTE default_gateway=96.31.90.129
Tue Dec 08 15:26:13 2009 TAP-WIN32 device [Local Area Connection 2] opened: \\.\
Global\{0602F6D1-2000-4C16-B681-3E9FEFE3200D}.tap
Tue Dec 08 15:26:13 2009 TAP-Win32 Driver Version 9.6
Tue Dec 08 15:26:13 2009 TAP-Win32 MTU=1500
Tue Dec 08 15:26:13 2009 Notified TAP-Win32 driver to set a DHCP IP/netmask of 1
0.8.0.1/255.255.255.252 on interface {0602F6D1-2000-4C16-B681-3E9FEFE3200D} [DHC
P-serv: 10.8.0.2, lease-time: 31536000]
Tue Dec 08 15:26:13 2009 Sleeping for 10 seconds...
Tue Dec 08 15:26:23 2009 Successful ARP Flush on interface [21] {0602F6D1-2000-4
C16-B681-3E9FEFE3200D}
Tue Dec 08 15:26:24 2009 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255
.255.0 10.8.0.2
Tue Dec 08 15:26:24 2009 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=21]
Tue Dec 08 15:26:24 2009 Route addition via IPAPI failed [adaptive]
Tue Dec 08 15:26:24 2009 Route addition fallback to route.exe
The route addition failed: The object already exists.

Tue Dec 08 15:26:24 2009 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:
0 EL:0 AF:3/1 ]
Tue Dec 08 15:26:24 2009 Listening for incoming TCP connection on 96.31.90.174:1
937
Tue Dec 08 15:26:24 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Dec 08 15:26:24 2009 TCPv4_SERVER link local (bound): 96.31.90.174:1937
Tue Dec 08 15:26:24 2009 TCPv4_SERVER link remote: [undef]
Tue Dec 08 15:26:25 2009 MULTI: multi_init called, r=256 v=256
Tue Dec 08 15:26:25 2009 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Dec 08 15:26:25 2009 IFCONFIG POOL LIST
Tue Dec 08 15:26:25 2009 MULTI: TCP INIT maxclients=60 maxevents=64
Tue Dec 08 15:26:25 2009 Initialization Sequence Completed
Tue Dec 08 15:26:33 2009 MULTI: multi_create_instance called
Tue Dec 08 15:26:33 2009 Re-using SSL/TLS context
Tue Dec 08 15:26:33 2009 LZO compression initialized
Tue Dec 08 15:26:33 2009 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:
0 EL:0 ]
Tue Dec 08 15:26:34 2009 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:
0 EL:0 AF:3/1 ]
Tue Dec 08 15:26:34 2009 Local Options hash (VER=V4): 'c0103fa8'
Tue Dec 08 15:26:34 2009 Expected Remote Options hash (VER=V4): '69109d17'
Tue Dec 08 15:26:34 2009 TCP connection established with 62.220.113.29:56336
Tue Dec 08 15:26:34 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Dec 08 15:26:34 2009 TCPv4_SERVER link local: [undef]
Tue Dec 08 15:26:34 2009 TCPv4_SERVER link remote: 62.220.113.29:56336
Tue Dec 08 15:26:34 2009 62.220.113.29:56336 TLS: Initial packet from 62.220.113
.29:56336, sid=fa280cbb 89e9998b
Tue Dec 08 15:26:38 2009 MULTI: multi_create_instance called
Tue Dec 08 15:26:38 2009 Re-using SSL/TLS context
Tue Dec 08 15:26:38 2009 LZO compression initialized
Tue Dec 08 15:26:38 2009 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:
0 EL:0 ]
Tue Dec 08 15:26:39 2009 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:
0 EL:0 AF:3/1 ]
Tue Dec 08 15:26:39 2009 Local Options hash (VER=V4): 'c0103fa8'
Tue Dec 08 15:26:39 2009 Expected Remote Options hash (VER=V4): '69109d17'
Tue Dec 08 15:26:39 2009 TCP connection established with 81.91.158.242:62068
Tue Dec 08 15:26:39 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Dec 08 15:26:39 2009 TCPv4_SERVER link local: [undef]
Tue Dec 08 15:26:39 2009 TCPv4_SERVER link remote: 81.91.158.242:62068
Tue Dec 08 15:26:39 2009 81.91.158.242:62068 TLS: Initial packet from 81.91.158.
242:62068, sid=cc8b77bc 966250fd
Tue Dec 08 15:27:34 2009 62.220.113.29:56336 TLS Error: TLS key negotiation fail
ed to occur within 60 seconds (check your network connectivity)
Tue Dec 08 15:27:34 2009 62.220.113.29:56336 TLS Error: TLS handshake failed
Tue Dec 08 15:27:34 2009 62.220.113.29:56336 Fatal TLS error (check_tls_errors_c
o), restarting
Tue Dec 08 15:27:34 2009 62.220.113.29:56336 SIGUSR1[soft,tls-error] received, c
lient-instance restarting
Tue Dec 08 15:27:34 2009 TCP/UDP: Closing socket
Tue Dec 08 15:27:39 2009 81.91.158.242:62068 TLS Error: TLS key negotiation fail
ed to occur within 60 seconds (check your network connectivity)
Tue Dec 08 15:27:39 2009 81.91.158.242:62068 TLS Error: TLS handshake failed
Tue Dec 08 15:27:39 2009 81.91.158.242:62068 Fatal TLS error (check_tls_errors_c
o), restarting
Tue Dec 08 15:27:39 2009 81.91.158.242:62068 SIGUSR1[soft,tls-error] received, c
lient-instance restarting
Tue Dec 08 15:27:40 2009 TCP/UDP: Closing socket
openvpn
EN

回答 3

Server Fault用户

回答已采纳

发布于 2009-12-08 20:56:00

您在客户端配置中指定了端口1937，但为服务器配置中指定的服务器侦听端口1194。尽管如此，您的服务器日志显示它正在监听端口1937，至少在您获取该日志时是这样的。除此之外，在我看来没有什么不对劲的。

看起来您在客户端和服务器之间确实获得了良好的TCP连接。为了排除任何PKI问题，我从静态键配置开始，一旦成功，就转到公钥配置。

票数 2
EN

Server Fault用户

发布于 2009-12-09 14:36:32

您可以从检查以下几件事情开始：

  • 你的核证人签得好吗？
  • 您指定了"ns-cert-type server“选项。是否使用此选项生成了服务器证书？
  • 您可以使用更详细的(动词4-9)，以便获得更多关于失败的信息。
票数 0
EN

Server Fault用户

发布于 2014-10-14 10:33:02

几天前我也遇到了同样的问题，我解决了这个问题。我将客户端的*.csr文件添加到带有证书和密钥的客户端包中，所有操作都正常。

票数 0
EN
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://serverfault.com/questions/92312

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2025 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档