# TLS handshake error after restoring backup onto new server

**URL:** <https://forum.pritunl.com/t/tls-handshake-error-after-restoring-backup-onto-new-server/3147>\
**Category:** Pritunl VPN\
**Created:** [March 26, 2025, 12:01pm UTC](https://forum.pritunl.com/t/tls-handshake-error-after-restoring-backup-onto-new-server/3147 "2025-03-26T12:01:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![matt.vugrinec](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/7c8e57/32.png) [@matt.vugrinec](https://forum.pritunl.com/u/matt.vugrinec)\
**Post date:** [March 26, 2025, 12:01pm UTC](https://forum.pritunl.com/t/tls-handshake-error-after-restoring-backup-onto-new-server/3147/1 "2025-03-26T12:01:12Z")

</div>

I had an older pritunl server(al2) which I have backed up and restore to a new al2023. I’ve edited some settings, okta+duo work, even pritunl is working just fine. In the web browser server logs I don’t see any error message.  
But when I ssh to the server and follow pritunl logs, I’m constantly getting this errors:  
TLS handshake error from xx.xx.xx.xx:9218: EOF  
…  
I have an enterprise licence and I’ve switched Lets Encrypt Domain from old server to the new one.  
Any help would be appreciated.  
Thank you

edit:  
errors that I’m seeing are coming from journalctl command, if I cat pritunl.log, I don’t see those TLS errors.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 28, 2025, 2:23am UTC](https://forum.pritunl.com/t/tls-handshake-error-after-restoring-backup-onto-new-server/3147/2 "2025-03-28T02:23:24Z")

</div>

It likely has the unsupported Lets Encrypt keys and API. You will need to either update the server or manually create the certificate outside of Pritunl and configure it in the top right settings under advanced. Run `sudo pritunl reset-ssl-cert` if the server web console is inaccessible due to SSL errors. Chrome may also block accessing the domain without a valid SSL certificate, if that occurs use the IP address of the server instead.

---

<div class="post-metadata">

**Author:** ![matt.vugrinec](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/7c8e57/32.png) [@matt.vugrinec](https://forum.pritunl.com/u/matt.vugrinec)\
**Post date:** [March 28, 2025, 8:09am UTC](https://forum.pritunl.com/t/tls-handshake-error-after-restoring-backup-onto-new-server/3147/3 "2025-03-28T08:09:11Z")

</div>

Problem was with the Global Accelerator doing health checks on TCP 443.