Troubleshoot SSL-VPN connection issues

Operating system

Default log file directory

Linux client with OpenVPN installed

/var/log/openvpn.log

Windows client with OpenVPN installed

By default, the log file is stored in the log folder of the directory in which OpenVPN is installed.

Example: C:\Users\User\OpenVPN\log.

macOS client with Tunnelblick installed

/Library/Application Support/Tunnelblick/Logs

macOS client with OpenVPN installed

/Library/Application Support/OpenVPN/log/connection_name.log

Category

Cause

Keyword

Solution

Network connection failure

Network communication is abnormal.

• network is unreachable

• TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

• TLS Error: TLS handshake failed

1. From your client, run the ping or mtr command to test connectivity to the public IP address of the VPN Gateway.

   • If the internet connection is poor due to high latency or packet loss, contact your internet service provider (ISP) for assistance.

   • If network connectivity is normal, check whether the SSL server logs contain the client's connection information.

     If no client connection records are found, try changing the Port used by the SSL server. Then, download and install a new SSL client certificate on the client.

2. Change the Protocol of the SSL server to TCP for better reliability.

   If you use an SSL-VPN connection for long-distance communication, such as from US (Silicon Valley) to Singapore, and the issue persists after you change the Protocol to TCP, we recommend using Cloud Enterprise Network and Smart Access Gateway to connect your client to the VPC.

3. If multiple VPN applications are installed on your client, use only one to create SSL-VPN connections.

4. Restart the client or reinstall the VPN application on the client.

Protocol or port number mismatch

The client and SSL server use different protocols or ports.

• MANAGEMENT: >STATE:1676379239,TCP_CONNECT,,,,,,

• TCP: connect to [AF_INET]*.*.*.*:1194 failed: Unknown error

Change the Protocol and Port on the SSL server, then download and install a new SSL client certificate on the client.

Excessive connections

The number of SSL-VPN connections exceeds the limit.

MANAGEMENT: >STATE:1676370715,WAIT,,,,,

1. Check whether the number of SSL clients connected to the VPN gateway exceeds the limit.

   • If the limit is exceeded, increase the maximum number of connections for the VPN gateway.

   • If the limit is exceeded and you do not want to increase it, disconnect idle clients. Resources are released about 5 minutes after a client disconnects.

2. Change the SSL server Protocol to TCP, then download and install a new SSL client certificate.

   This prevents unreliable UDP connections from occupying the connection quota. In addition, TCP connections are more reliable.

Certificate expiration

The SSL client certificate has expired.

VERIFY ERROR: certificate has expired

1. Check the validity period of the SSL client certificate.

   The default validity period of the SSL client certificate is three years.

2. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client.

   You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.

Certificate configuration error

The certificate configuration is invalid.

• Options error: --ca fails with 'ca.crt': No such file or directory (errno=2)

• Options error: --cert fails with 'vsc-****.crt': No such file or directory (errno=2)

• WARNING: cannot stat file 'vsc-****.key': No such file or directory (errno=2)

• Options error: --key fails with 'vsc-****.key'

• Options error: Please correct these errors.

Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client.

Incompatible VPN application versions

The version of the VPN application installed on the client is incompatible with the Alibaba Cloud SSL server.

• Data Channel Offload doesn't support DATA_V1 packets

• Upgrade your server to

• suggesting an upgrade to the server version

Uninstall the existing VPN application from the client and install a version compatible with the SSL server. For more information, see the "Step 4: Configure the client" section of the Connect a client to a VPC topic.

Insufficient IP addresses

The client CIDR block on the SSL server does not have enough IP addresses.

OpenVPN needs a gateway parameter for a -- route option and no default was specified by either --route-gateway or --ifconfig options

Make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the VPN gateway. For more information, see Create an SSL server.

For example, if you specify 192.168.0.0/24 as the client CIDR block, the system first divides a subnet CIDR block with a subnet mask of 30 from 192.168.0.0/24, such as 192.168.0.4/30. This subnet provides up to four IP addresses. Then, the system allocates an IP address from 192.168.0.4/30 to the client and uses the other three IP addresses to ensure network communication. In this case, one client consumes four IP addresses. Therefore, to ensure that an IP address can be allocated to your client, you must make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the associated VPN gateway.

Encryption algorithm mismatch

The SSL server and client use different TLS cipher suites and no matching encryption algorithm can be found.

• TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive.

• OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher

Install the VPN application recommended by VPN Gateway on your client. For more information, see the "Step 4: Configure the client" section of the Connect a client to a VPC topic.

Inconsistent encryption algorithms

The configurations of encryption algorithms in the SSL server and client are inconsistent.

Authenticate/Decrypt packet error: cipher final failed

Check whether the encryption algorithm of the SSL client certificate installed on the client is consistent with that of the SSL server.

If the encryption algorithms are inconsistent, delete the current SSL client certificate and all configurations, redownload the certificate, and then install the certificate on the client.

• The encryption algorithm for the SSL client certificate is the value of the cipher field in the config.ovpn file.

• To view the encryption algorithm of the SSL server, perform the following operations: Go to the SSL Servers page in the VPN Gateway console. Find the SSL server that you want to manage. Click Details in the Actions column. On the details page of the SSL server, view the encryption algorithm.

Packet ID conflict

The network connection is unstable or the encryption algorithm of the SSL server is set to none.

Authenticate/Decrypt packet error: bad packet ID (may be a replay)

1. Change the protocol used by the SSL server to TCP for higher reliability.

2. Check if the Encryption Algorithm for the SSL server is set to none. If it is, change the Encryption Algorithm to an AES algorithm, such as AES-128-CBC, AES-192-CBC, or AES-256-CBC.

3. After you modify the configuration of the SSL server, delete the current SSL client certificate and all configurations, redownload the certificate, and then install the certificate on the client.

Time synchronization issue

SSL verification fails or the time difference between the client and SSL server exceeds 10 minutes.

• OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

• TLS_ERROR: BIO read tls_read_plaintext error

• TLS Error: TLS object -> incoming plaintext read error

• TLS Error: TLS handshake failed

1. The time difference between the client and SSL server must not exceed 10 minutes. Synchronize the client time with a standard time source.

2. Check the validity period of the SSL client certificate.

   The default validity period of the SSL client certificate is three years.

Certificate verification failure

The SSL certificate verification fails.

No server certificate verification method has been enabled

1. Check the SSL client certificate validity.

   By default, SSL client certificates are valid for three years.

2. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client.

   You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.

Two-factor authentication failure

The two-factor authentication fails.

• AUTH: Received control message: AUTH_FAILED

• TCP/UDP: Closing socket

• SIGUSR1[soft,auth-failure] received, process restarting

• MANAGEMENT: >STATE:1676381342,RECONNECTING,auth-failure,,,,,

1. Check whether you entered a valid username and password.

2. Check whether the account is configured in the IDaaS instance, whether the account is disabled, and whether the IDaaS instance has expired. For more information, see What is IDaaS?

   If the IDaaS instance is not the cause, try a different account.

3. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client.

   You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.

Missing TAP adapter

The client does not have a TAP virtual Ethernet adapter.

• There are no TAP-Windows adapters on this system. You should be able to create a TAP

• CreateFile failed on TAP device

• All TAP-Win32 adapters on this system are currently in use

1. Confirm that you selected the TAP virtual Ethernet adapter option when you installed the OpenVPN software.

   If you did not select this option during installation, create a TAP virtual Ethernet adapter or reinstall OpenVPN.

2. Close OpenVPN. Then, run OpenVPN as an administrator.

Stopped ovpnagent program

The ovpnagent program on a macOS client is not running.

Transport Error: socket_protect error

1. Run the following command by using the CLI of the client to start the ovpnagent program:

   /Library/Frameworks/OpenVPNConnect.framework/Versions/Current/usr/sbin/ovpnagent

2. For macOS clients, we recommend using Tunnelblick to create SSL-VPN connections.

Frequent client reconnection

The client automatically reconnects to the server.

• Connection reset, restarting [-1]SIGUSR1[soft,connection-reset] received, client-instance restarting

• TCP/UDP: Closing socket

1. Check whether the client restarted or reconnected at the time shown in the logs.

2. Check the SSL client certificate validity.

   By default, SSL client certificates are valid for three years.

3. Check the client system time.

   The time difference between the client and SSL server must not exceed 10 minutes. Synchronize the client time with a standard time source.