Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Solved: ExpressVPN connection error Data channel cipher negotiation failed (no shared cipher)

    Scheduled Pinned Locked Moved OpenVPN
    15 Posts 7 Posters 12.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 4
      4o4rh @Gertjan
      last edited by 4o4rh

      @Gertjan my end point was in germany and was working for many, many moons. all of a sudden there was 100% packet loss despite no changes on my side. tried luxembourg and netherlands. same thing. expressvpn support assured me, they made no changes. purely coincidential, to make it work one has to change the encryption type.....right..... "maybe you are using a expressvpn location they forgot to update" - it was using AES-256-CBC for years. that is what is in their opvn config, but now all of a sudden i have to use AES-256-GCM to get a connection. that is something changed on expressvpn, not on the client

      V GertjanG 2 Replies Last reply Reply Quote 0
      • V
        vlurk @4o4rh
        last edited by

        Same issue here, same fix (replace AES-256-CBC by AES-256-GCM).

        The funny thing is.... I redownloaded the manual config file for the server that I use and the config statement "cipher AES-256-CBC" was still there. The config they provide is broken, and it might be the case for more than a few servers.

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @4o4rh
          last edited by

          @gwaitsi

          I guess, as I was using this :

          57755cce-8822-41f7-8837-3f7a2434c12a-image.png

          so : 'CBC' or 'GCM' : it will work it out by itself ....

          Most North Europe ovpn files use "cipher AES-256-CBC" right now.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          P 1 Reply Last reply Reply Quote 0
          • P
            polo2883 @Gertjan
            last edited by

            Changed my encryption to AES-256-GCM and I am still getting the error:
            AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)
            SIGUSR1[soft,auth-failure] received, process restarting

            1 Reply Last reply Reply Quote 0
            • S
              shdwkeeper @4o4rh
              last edited by shdwkeeper

              @gwaitsi Found this on Expressvpn site: How secure is ExpressVPN encryption?
              Control-channel encryption
              To ensure the integrity and confidentiality of encrypted data even on low-powered hardware, ExpressVPN uses AES-256-GCM. AES is one of the most widely used symmetric encryption standards. The 256 refers to the fixed size of each encrypted block, 256 bits. GCM (Galois/Counter Mode) allows your computer to encrypt multiple packages at once, ensuring that your connection never hangs even for a short moment.

              4 1 Reply Last reply Reply Quote 1
              • 4
                4o4rh @shdwkeeper
                last edited by

                @shdwkeeper must be new, cause i was using CBC for years, until 6 days ago when the connection just dropped. they must be deploying one because all the profiles still have CBC. Anyways, i'm working, so i'm happy

                GertjanG S 2 Replies Last reply Reply Quote 0
                • GertjanG
                  Gertjan @4o4rh
                  last edited by

                  If you use "OpenVPN" : take note of this post : HEADS UP: OpenVPN deprecating shared key mode, requires TLS, deprecating cipher selection

                  So, you should have :

                  0ce54bff-62c8-4995-9d1d-36d351f1421d-image.png

                  the first 3 because of : "that's what OpenVPN proposes".
                  and the fourth : because ExpressVPN needs it. Or was needing it before, and now uses some 'GCM'.

                  Clear is : 'CBC' will get phased out.

                  ExpressVPN most probably uses the same publicly available OpenVPN server code, and 'adapted' it for their own needs.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  S 1 Reply Last reply Reply Quote 1
                  • S
                    shdwkeeper @4o4rh
                    last edited by

                    @gwaitsi
                    I agree I was working for years untill this last week and it went down, than I found this post and started researching it. Once I made this change it started working. So they need to update their documentation.

                    1 Reply Last reply Reply Quote 0
                    • S
                      shdwkeeper @Gertjan
                      last edited by

                      @Gertjan
                      So your saying add all of these and use GCM as the fallback as well?

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @vlurk
                        last edited by

                        @shdwkeeper said in Solved: ExpressVPN connection error Data channel cipher negotiation failed (no shared cipher):

                        So your saying add all of these and use GCM as the fallback as well?

                        It works for me.

                        @vlurk said in Solved: ExpressVPN connection error Data channel cipher negotiation failed (no shared cipher):

                        The funny thing is.... I redownloaded the manual config file for the server that I use and the config statement "cipher AES-256-CBC" was still there. The config they provide is broken, and it might be the case for more than a few servers.

                        Exact. When you download a ovpn file for a typical country/place, is still says '....CBC' as the encryption key.
                        I'm using one right now for France => Paris.

                        When I connect :

                        Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
                        

                        and you can clearly see the GCM - non CBC.

                        That's why I said " add them all and let them figure it out among client and server "

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        PippinP 1 Reply Last reply Reply Quote 0
                        • PippinP
                          Pippin @Gertjan
                          last edited by

                          @Gertjan said in Solved: ExpressVPN connection error Data channel cipher negotiation failed (no shared cipher):

                          Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256

                          That's the control channel ;)
                          .
                          Data channel is this one:

                          2023-06-26 11:08:24 us=684115 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
                          2023-06-26 11:08:24 us=684160 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
                          

                          I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                          Halton Arp

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.