The Client Log Contains "TLS Error: TLS handshake failed"

Applicable Client

• Linux
• Windows OpenVPN GUI

Symptom

A client cannot connect to a P2C VPN gateway, and the log contains the following error information:

TLS Error: TLS handshake failed

Possible Causes

The certificate and private key in the client configuration file do not match the client CA certificate imported on the Server tab page of the VPN gateway.

Procedure

1. Check whether the imported client CA certificate is correct.
   1. Log in to the management console.
   2. Click in the upper left corner and select the desired region and project.
   3. Click in the upper left corner, and choose Networking > Virtual Private Network.
   4. In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Gateways.
   5. Click the P2C VPN Gateways tab. In the P2C VPN gateway list, locate the target P2C VPN gateway, and click View Server in the Operation column.
   6. On the Server tab page, view the issuer information of the client CA certificate.
   7. Double-click the target client CA certificate, click the Details tab, and view the issuer information.
      • If the issuer information on the client is consistent with that on the server, go to step 2.
      • If the issuer information on the client is inconsistent with that on the server, perform the following operations to import the client CA certificate again:
      1. On the Server tab page, choose Certificate authentication from the Client Authentication Mode drop-down list box, and click Upload CA Certificate.
      2. Set parameters as prompted.

         Table 1 Parameters for uploading a CA certificate

         Parameter	Description	Example Value
         Name	This parameter can be modified.	ca-cert-xxxx
         Content	Use a text editor (for example, Notepad++) to open the signature certificate file in PEM format, and copy the certificate content to this text box. NOTE: It is recommended to use a certificate with a strong cryptographic algorithm, such as RSA-3072 or RSA-4096. Certificates using the RSA-2048 encryption algorithm have risks. Exercise caution when using such certificates.	-----BEGIN CERTIFICATE----- Certificate content -----END CERTIFICATE-----

      3. Click OK.
      4. Click Delete in the Operation column of the incorrect client CA certificate.
      5. In the Delete CA Certificate dialog box, click OK.
   8. Download the new client configuration file.
   9. The downloaded client configuration file is client_config.zip.
   10. Decompress client_config.zip to a specified directory, for example, D:\.

       After the decompression, the client_config.ovpn and client_config.conf files are generated.

   11. Open the client_config.ovpn file using Notepad or Notepad++.
   12. Add the client certificate and private key to the file.
       Enter the client certificate content and the corresponding private key in between <cert></cert> and <key></key> tags, respectively.

       <cert>
       -----BEGIN CERTIFICATE-----
       Client certificate content
       -----END CERTIFICATE-----
       </cert>
       
       <key>
       -----BEGIN PRIVATE KEY-----
       Client private key
       -----END PRIVATE KEY-----
       </key>

   13. Save the .ovpn configuration file.
   14. Start the OpenVPN client.
   15. Import the new client configuration file.
   16. Use the client to reconnect to the VPN gateway.
2. Check whether the client certificate and private key in the configuration file match.

   If the client CA certificate imported in step 1 is correct, the client certificate and private key in the configuration file do not match. In this case, copy the client certificate and private key to the client configuration file again.

   1. Open the client_config.ovpn, p2cclient.com.crt, and p2cclient.com.key files using Notepad or Notepad++. In this example, p2cclient.com.crt is the client certificate, and p2cclient.com.key is the client private key.
   2. Copy the client certificate and private key to the client_config.ovpn file.

      Enter the client certificate content and the corresponding private key in between <cert></cert> and <key></key> tags, respectively. An example is as follows:

      <cert>
      -----BEGIN CERTIFICATE-----
      Client certificate content
      -----END CERTIFICATE-----
      </cert>
      
      <key>
      -----BEGIN PRIVATE KEY-----
      Client private key
      -----END PRIVATE KEY-----
      </key>

   3. Save the .ovpn configuration file.
   4. Start the OpenVPN client.
   5. Import the new client configuration file.
   6. Use the client to reconnect to the VPN gateway.
   7. On Windows, press Win+R and enter cmd to open the command window.

      On Linux, log in as the root user and open the command window.

   8. 

      XX.XX.XX.XX indicates the private IP address of the ECS to be connected. Replace it with the actual private IP address.

      If information similar to the following is displayed, the client can communicate with the ECS:

      64 bytes from XX.XX.XX.XX: icmp_seq=1 ttl=63 time=1.27 ms
      64 bytes from XX.XX.XX.XX: icmp_seq=2 ttl=63 time=1.36 ms
      64 bytes from XX.XX.XX.XX: icmp_seq=3 ttl=63 time=1.40 ms
      64 bytes from XX.XX.XX.XX: icmp_seq=4 ttl=63 time=1.29 ms
      64 bytes from XX.XX.XX.XX: icmp_seq=5 ttl=63 time=1.35 ms
      64 bytes from XX.XX.XX.XX: icmp_seq=6 ttl=63 time=1.52 ms

If you use a client on Linux, you need to upload the configuration file client_config.conf to the Linux system using Xftp. For details, see Configuring a Client.

If the problem persists, submit a service ticket to contact Huawei technical support.