Bug: VPN Unlimited TLS Error: TLS handshake failed

[Joyfal]

Is this urgent?

Yes

Host OS

Raspberry Pi

CPU arch

aarch64

VPN service provider

VPNUnlimited

What are you using to run the container

docker run

What is the version of Gluetun

Running version latest built on 2025-01-22T08:30:14.628Z (commit 13532c8)

What's the problem 🤔

Stopped working today, I believe the CA certificates expired.

New CA certificates from the new cfg is

<ca>
-----BEGIN CERTIFICATE-----
MIIECjCCA2ygAwIBAgIRAJ/aLZu0PCO7LlOTcPQE9UwwCgYIKoZIzj0EAwQwgasx
CzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOWTERMA8GA1UEBwwITmV3IFlvcmsxFzAV
BgNVBAoMDktlZXBTb2xpZCBJbmMuMR4wHAYDVQQLDBVLZWVwU29saWQgVlBOIFJv
b3QgQ0ExHjAcBgNVBAMMFUtlZXBTb2xpZCBWUE4gUm9vdCBDQTEjMCEGCSqGSIb3
DQEJARYUYWRtaW5zQGtlZXBzb2xpZC5jb20wHhcNMjUwMzMxMTQ0OTU4WhcNMzAw
NjEzMTQ0OTU4WjCBqTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYDVQQH
DAhOZXcgWW9yazEXMBUGA1UECgwOS2VlcFNvbGlkIEluYy4xHTAbBgNVBAsMFEtl
ZXBTb2xpZCBPcGVuVlBOIENBMR0wGwYDVQQDDBRLZWVwU29saWQgT3BlblZQTiBD
QTEjMCEGCSqGSIb3DQEJARYUYWRtaW5zQGtlZXBzb2xpZC5jb20wgZswEAYHKoZI
zj0CAQYFK4EEACMDgYYABAEHfJRyn9MZ7HQctQULIxVUNFFw+tWetokml5PvIsS1
i3mM4NQnj0HHL5zCCQRKUmSiiWtGvbGlsHEWX/hz+NiVoQGjMqBD2ykdLimiFrce
onIofEBZW8to6jTjG3wmJkRykDqsuLyBLUKGc2F5dR3YFGgwyDoRz0NaAYI+qgqW
fE+cVaOCASwwggEoMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFB4IhTj1gStDx+fN
q+ubBcr+lEbwMIHrBgNVHSMEgeMwgeCAFOEcFx6OcN8T1R8lTdCLhFlYuk5joYGx
pIGuMIGrMQswCQYDVQQGEwJVUzELMAkGA1UECAwCTlkxETAPBgNVBAcMCE5ldyBZ
b3JrMRcwFQYDVQQKDA5LZWVwU29saWQgSW5jLjEeMBwGA1UECwwVS2VlcFNvbGlk
IFZQTiBSb290IENBMR4wHAYDVQQDDBVLZWVwU29saWQgVlBOIFJvb3QgQ0ExIzAh
BgkqhkiG9w0BCQEWFGFkbWluc0BrZWVwc29saWQuY29tghRnfb8jJuxu5dJzLm5Z
durkedrxzjALBgNVHQ8EBAMCAQYwCgYIKoZIzj0EAwQDgYsAMIGHAkIBg8Cdu474
VlljCoP8WEr6xErKL6Bygy5+SO1Ey0Uu3B7q8R22F0EWvrOmqmyNZ3oRyqhpUGaE
BqB2aqDGT7u7wGsCQUP3nyMlDbXqCF05byMbhQrBsCz1nyqDNnfzM2uGmT09XwWX
GCYTIGdynyJJLzdOlpf3T19ZLvqLSf6Kvq45u6si
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEEDCCA3GgAwIBAgIUZ32/IybsbuXScy5uWXbq5Hna8c4wCgYIKoZIzj0EAwQw
gasxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOWTERMA8GA1UEBwwITmV3IFlvcmsx
FzAVBgNVBAoMDktlZXBTb2xpZCBJbmMuMR4wHAYDVQQLDBVLZWVwU29saWQgVlBO
IFJvb3QgQ0ExHjAcBgNVBAMMFUtlZXBTb2xpZCBWUE4gUm9vdCBDQTEjMCEGCSqG
SIb3DQEJARYUYWRtaW5zQGtlZXBzb2xpZC5jb20wHhcNMjUwMzMxMTQ0NTUzWhcN
MzUwODI2MTQ0NTUzWjCBqzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYD
VQQHDAhOZXcgWW9yazEXMBUGA1UECgwOS2VlcFNvbGlkIEluYy4xHjAcBgNVBAsM
FUtlZXBTb2xpZCBWUE4gUm9vdCBDQTEeMBwGA1UEAwwVS2VlcFNvbGlkIFZQTiBS
b290IENBMSMwIQYJKoZIhvcNAQkBFhRhZG1pbnNAa2VlcHNvbGlkLmNvbTCBmzAQ
BgcqhkjOPQIBBgUrgQQAIwOBhgAEAN77xqCz3wrFDnRMtggwScgvO6wPFZYECTUu
5WW0JaowgmuIgo+BiQQyTeUzJEICulc1Hg7EaUEV+z8jsSrB+4/EAWazn/ufWOx/
51fa5FCv4YooCbgLPb1CzYDuTc7MUR5PLQ88o3W01wCCgT8RoNH8uChyPBLUBh2f
4rUfpzl20Bqdo4IBLDCCASgwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU4RwXHo5w
3xPVHyVN0IuEWVi6TmMwgesGA1UdIwSB4zCB4IAU4RwXHo5w3xPVHyVN0IuEWVi6
TmOhgbGkga4wgasxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOWTERMA8GA1UEBwwI
TmV3IFlvcmsxFzAVBgNVBAoMDktlZXBTb2xpZCBJbmMuMR4wHAYDVQQLDBVLZWVw
U29saWQgVlBOIFJvb3QgQ0ExHjAcBgNVBAMMFUtlZXBTb2xpZCBWUE4gUm9vdCBD
QTEjMCEGCSqGSIb3DQEJARYUYWRtaW5zQGtlZXBzb2xpZC5jb22CFGd9vyMm7G7l
0nMubll26uR52vHOMAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDBAOBjAAwgYgCQgCZ
tqE+wXwH0ixjWafX3SClp8O3bYeyB/7jbzf8MprXRYBVQ8JjvugjaZTvX82Uy++L
aN3oHqK+NUhJUdfZx/eIuQJCAad7HpsKyTYuUUkgAgWXJma4MstxyO9PVRNYozi1
oc45Z8deSvwy404n3u1kY5QXLZQaaMY7m2pF+ECs4WkKCh5s
-----END CERTIFICATE-----
</ca>

Share your logs (at least 10 lines)

gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] VERIFY ERROR: depth=2, error=self-signed certificate in certificate chain: C=US, ST=NY, L=New York, O=KeepSolid Inc., OU=KeepSolid VPN Root CA, CN=KeepSolid VPN Root CA, emailAddress=admins@keepsolid.com, serial=590830292952905902500539248317331898854520058318
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] OpenSSL: error:0A000086:SSL routines::certificate verify failed:
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] TLS_ERROR: BIO read tls_read_plaintext error
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] TLS Error: TLS object -> incoming plaintext read error
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] TLS Error: TLS handshake failed
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] SIGTERM received, sending exit notification to peer
gluetun  | 2025-04-01T03:06:53Z INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[dmitriykhait]

As a temp fix, i just downloaded the config file from keepsolid and used custom

 - VPN_SERVICE_PROVIDER=custom
 - OPENVPN_CUSTOM_CONFIG=/gluetun/default.ovpn

[jgeorge1983]

I just tried to do this, I went onto KeepSolid, downloaded a openVPN config(does it matter which country i select) I then set it to linux and downloaded the file.

Copied that to my docker directory, renamed it to default.ovpn

My compose file now looks like this:

    environment:
      - VPN_TYPE=openvpn
      - VPN_SERVICE_PROVIDER=custom
      - OPENVPN_CUSTOM_CONFIG=/gluetun/default.ovpn      
      #- VPN_SERVICE_PROVIDER=vpn unlimited
      - OPENVPN_USER=<USERNAME>
      - OPENVPN_PASSWORD=<PASsWORD>
      #- SERVER_COUNTRIES=Romania
      - SERVER_COUNTRIES=France      
      #- SERVER_COUNTRIES=Canada 

but I get this error:
ERROR VPN settings: provider settings: server selection: for VPN service provider custom: the country specified is not valid: one or more values is set but there is no possible value available

France is in the servers.json file.

Did I do something that you didnt?

[dmitriykhait]

you got to comment out - SERVER_COUNTRIES=France because custom doesnt support country. the country will be in your ovpn file, the other hting you will need to do is change dns to ips, for some reason it doesnt work with dns, so modify the ovpn file remote blaha.vpnblaha.blah to get ips with nslookup blaha.vpnblaha.blah

remote ip1
remote ip2
remote ip3

[jgeorge1983]

nice one, yeh i saw that in some other guides, in the end i used the wireguard way of working.

[Fletch-99]

When using the KeepSolid config OpenVpn file and custom on docker compose, it gives me an error

extracting information from custom configuration file: extracting connection from file: on line 128: extracting from remote line: host is not an IP address: ro.vpnunlimitedapp.com

[dmitriykhait]

When using the KeepSolid config OpenVpn file and custom on docker compose, it gives me an error

extracting information from custom configuration file: extracting connection from file: on line 128: extracting from remote line: host is not an IP address: ro.vpnunlimitedapp.com

you need to change to ip instead of domain , see #2760 (comment)

[poudenes]

Hi All,

Try to set this up on my Synology NAS but won't work for now:

version: "3.9"
services:

  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    hostname: gluetun
    restart: always
    mem_limit: 512m
    cpu_shares: 1024
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8090:8090/tcp # port for qbittorrent
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /volumeUSB1/usbshare/docker/gluetun:/gluetun
    environment:
      PUID: 1026
      PGID: 100
      TZ: Europe/Amsterdam      
      VPN_SERVICE_PROVIDER: custom
      VPN_TYPE: openvpn
      OPENVPN_USER: KS2-USERNAME
      OPENVPN_PASSWORD: PASSWORD
      OPENVPN_CUSTOM_CONFIG: /gluetun/openvpn/fr_torrent.ovpn
      HTTPPROXY: off
      SHADOWSOCKS: off
      FIREWALL_OUTBOUND_SUBNETS: 192.168.100.0/24
      UPDATER_PERIOD: 24h
    cap_add:
      - NET_ADMIN
    network_mode: synology
    security_opt:
      - no-new-privileges:true

└── Version settings:
    └── Enabled: yes
2025-04-05T16:05:03+02:00 INFO [routing] default route found: interface eth0, gateway 172.30.32.1, assigned IP 172.30.33.0 and family v4
2025-04-05T16:05:03+02:00 INFO [routing] adding route for 0.0.0.0/0
2025-04-05T16:05:03+02:00 INFO [firewall] setting allowed subnets...
2025-04-05T16:05:03+02:00 INFO [routing] default route found: interface eth0, gateway 172.30.32.1, assigned IP 172.30.33.0 and family v4
2025-04-05T16:05:03+02:00 INFO [routing] adding route for 172.30.33.0/24
2025-04-05T16:05:03+02:00 INFO [routing] adding route for 192.168.100.0/24
2025-04-05T16:05:03+02:00 INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2025-04-05T16:05:03+02:00 INFO [dns] using plaintext DNS at address 1.1.1.1
2025-04-05T16:05:03+02:00 INFO [http server] http server listening on [::]:8000
2025-04-05T16:05:03+02:00 INFO [healthcheck] listening on 127.0.0.1:9999
2025-04-05T16:05:03+02:00 INFO [firewall] allowing VPN connection...
2025-04-05T16:05:03+02:00 ERROR [vpn] exit status 1
2025-04-05T16:05:03+02:00 INFO [vpn] retrying in 15s
2025-04-05T16:05:09+02:00 INFO [healthcheck] program has been unhealthy for 6s: restarting VPN (healthcheck error: dialing: dial tcp4: lookup cloudflare.com on 1.1.1.1:53: write udp 172.30.33.0:43677->1.1.1.1:53: write: operation not permitted)
2025-04-05T16:05:09+02:00 INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-04-05T16:05:09+02:00 INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2025-04-05T16:05:18+02:00 INFO [firewall] allowing VPN connection...
2025-04-05T16:05:18+02:00 ERROR [vpn] exit status 1
2025-04-05T16:05:18+02:00 INFO [vpn] retrying in 30s

[deboy69]

still getting TLS error with custom

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Update: that selected server wasnt working. Put in another one and is working with custom