Bug: TLS Handshake error when using protonvpn on openvpn

[kazak-99]

Is this urgent?

None

Host OS

Ubuntu 24.04

CPU arch

aarch64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-08-07T11:45:47.701Z (commit 7eed6ea) on Linux 6.8.0-137-generic (aarch64)

What's the problem 🤔

TLS Handshake error when using protonvpn on openvpn

Share your logs (at least 10 lines)

2026-08-10T09:00:51.330590920Z [gluetun] 2026-08-10T09:00:51Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 20 seconds (check your network connectivity)
2026-08-10T09:00:51.330648800Z [gluetun] 🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
2026-08-10T09:00:51.330655440Z [gluetun] That error usually happens because either:
2026-08-10T09:00:51.330659960Z [gluetun] 
2026-08-10T09:00:51.330663800Z [gluetun] 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
2026-08-10T09:00:51.330667880Z [gluetun]    Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2026-08-10T09:00:51.330673840Z [gluetun] 
2026-08-10T09:00:51.330677400Z [gluetun] 2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
2026-08-10T09:00:51.330681960Z [gluetun] 
2026-08-10T09:00:51.330685640Z [gluetun] 3. Your Internet connection is not working 🤯, ensure it works
2026-08-10T09:00:51.330689600Z [gluetun] 
2026-08-10T09:00:51.330693440Z [gluetun] 4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-08-10T09:00:51.330697480Z [gluetun] 
2026-08-10T09:00:51.330701080Z [gluetun] 2026-08-10T09:00:51Z INFO [openvpn] TLS Error: TLS handshake failed
2026-08-10T09:00:51.330705040Z [gluetun] 2026-08-10T09:00:51Z INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-08-10T09:00:51.331065120Z [gluetun] 2026-08-10T09:00:51Z INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-08-10T09:00:51.333225000Z [gluetun] 2026-08-10T09:00:51Z INFO [vpn] retrying in 15s
2026-08-10T09:01:06.337594800Z [gluetun] 2026-08-10T09:01:06Z INFO [firewall] allowing VPN connection...
2026-08-10T09:01:06.427658600Z [gluetun] 2026-08-10T09:01:06Z INFO [openvpn] OpenVPN 2.6.20 aarch64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-08-10T09:01:06.427716600Z [gluetun] 2026-08-10T09:01:06Z INFO [openvpn] library versions: OpenSSL 3.5.7 9 Jun 2026, LZO 2.10
2026-08-10T09:01:06.430379920Z [gluetun] 2026-08-10T09:01:06Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]89.222.96.1:1194
2026-08-10T09:01:06.430621680Z [gluetun] 2026-08-10T09:01:06Z INFO [openvpn] UDPv4 link local: (not bound)
2026-08-10T09:01:06.430638800Z [gluetun] 2026-08-10T09:01:06Z INFO [openvpn] UDPv4 link remote: [AF_INET]89.222.96.1:1194
2026-08-10T09:01:26.879895600Z [gluetun] 2026-08-10T09:01:26Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 20 seconds (check your network connectivity)

Share your configuration

services:
  gluetun:
    container_name: gluetun
    image: qmcgaw/gluetun:latest
    restart: always

    cap_add:
      - NET_ADMIN

    devices:
      - /dev/net/tun:/dev/net/tun

    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
      - OPENVPN_USER=REDACTED
      - OPENVPN_PASSWORD=REDACTED
      - SERVER_COUNTRIES=Switzerland

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[JPar99]

@kazak-99 Can you please update your bug title to Bug: TLS Handshake error when using protonvpn on openvpn ?

[gabry45]

Same for PIA with OpenVPN, with 4 different IPv4 servers. Usually it solves itself in a couple of retry. This time it has been two days and still nothing. Of course I tried restarting and recreating the container multiple times but nothing seems to work:

2026-08-10T12:05:35Z INFO [firewall] allowing VPN connection...
2026-08-10T12:05:35Z INFO [openvpn] OpenVPN 2.6.20 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-08-10T12:05:35Z INFO [openvpn] library versions: OpenSSL 3.5.7 9 Jun 2026, LZO 2.10
2026-08-10T12:05:35Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.77.218:1198
2026-08-10T12:05:35Z INFO [openvpn] UDPv4 link local: (not bound)
2026-08-10T12:05:35Z INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.77.218:1198
2026-08-10T12:05:55Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 20 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-08-10T12:05:55Z INFO [openvpn] TLS Error: TLS handshake failed
2026-08-10T12:05:55Z INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-08-10T12:05:55Z INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-08-10T12:05:55Z INFO [vpn] retrying in 15s

[kazak-99]

@kazak-99 Can you please update your bug title to Bug: TLS Handshake error when using protonvpn on openvpn ?

Done!

[dannnyo]

I started having this problem yesterday with PIA. Same result trying different servers or just different errors that keep the container from starting at all.
eta: I'm using portainer, because i'm a dumbass with stuff like this so I may be causing some of the problems myself.

[bencollinz]

add another to this list. tried different regions of PIA no luck, went to previous version, no luck.
"VPN server IP address you are trying to connect to is no longer valid", etc.
Edit: downgrade to 3.41.2 and now working

[HerrStinson]

Same error here with PIA amd OpenVPN.

[jrtnq514]

This maybe due to the VPN rotating IPs.

[kazak-99]

This maybe due to the VPN rotating IPs.

Whos this in reply to?

[sgoettsch]

Having same issue with PIA and v3.41.3. Downgraded to v3.41.2 and connection to PIA works fine again

[dannnyo]

I doubt it the rotating IP. I had to create a new stack but its working with my usual server. Now i'm having issues with qbittorrent not rechecking things after successfully checking the first batch. I'll try my old stack downgrading to 3.41.3 and see if i can get my old stack working.

[bencollinz]

Having same issue with PIA and v3.41.3. Downgraded to v3.41.2 and connection to PIA works fine again

Same. Had to downgrade to 3.41.2

[rikbon]

Downgraded to 3.41.2

docker ps -a | grep glue
30396bd0631b qmcgaw/gluetun:v3.41.2 "/gluetun-entrypoint" 5 minutes ago Up 5 minutes (unhealthy) [....] gluetun

---

Still not working
2026-08-19T07:45:15Z INFO [openvpn] library versions: OpenSSL 3.5.7 9 Jun 2026, LZO 2.10
2026-08-19T07:45:15Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]45.157.112.105:1198
2026-08-19T07:45:15Z INFO [openvpn] UDPv4 link local: (not bound)
2026-08-19T07:45:15Z INFO [openvpn] UDPv4 link remote: [AF_INET]45.157.112.105:1198
2026-08-19T07:46:15Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:

1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose

---

UPDATE: went also to 3.41.1 but nothing changed...

I was on 3.40, everything was working, then suddenly it stopped working

[gabry45]

Just found out the issue, for me at least. Seems that I had only two custom parameters in place, one of which was not supported anymore by PIA. I was using encryption "normal", but:
#3288
https://helpdesk.privateinternetaccess.com/hc/en-us/articles/46815533594011-Removing-OpenVPN-Handshake-and-Authentication-Settings
pia-foss/manual-connections@8a75e46
pia-foss/manual-connections#211

Removing the environment variable "-e PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET=normal" solved the issue. Probably PIA was slowly implementing this change over to their server and eventually they got to patch all my server region.
Hope this helps someone else.