ANSWERED tls_process: killed expiring key

[jabajools 2]

Morning all,

One of my clients keeps spamming the 'tls_process: killed expiring key' msg every hour, is this something I should be worried about?

Regards,

 

[Staff 9751]

Hello!

It's the Data Channel key re-negotiation over the Control Channel via Diffie-Hellman Exchange. See also Perfect Forward Secrecy: https://en.wikipedia.org/wiki/Forward_secrecy

You can lower the re-negotiation time on your client side with directive reneg-sec n, where n is in seconds, but you can't increase it and you can't disable forward secrecy (anyway you don't want to disable it).

OpenVPN re-negotiates Data Channel key by using overlapping time windows. During the negotiation, the previous key is used for any packet flow, so you will not notice any communication breakdown. When the message "killed expiring key" appears, it means that the negotiation completed successfully and the previous key is not used anymore.

AirVPN uses unique DH keys. Each VPN server has a different and unique key. DH key size is 4096 bit.

Kind regards
 

[jabajools 2]

rgr thank you