# WireGuard connection giving TLS handshake timeout **URL:** \ **Category:** Pritunl VPN\ **Tags:** pritunl-client, pritunl\ **Created:** [January 13, 2026, 4:39pm UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682 "2026-01-13T16:39:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![macsire](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/8e7dd6/32.png) [@macsire](https://forum.pritunl.com/u/macsire)\ **Post date:** [January 13, 2026, 4:39pm UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/1 "2026-01-13T16:39:33Z")
Hey @zach, seems like I’m having issues with this TLS handshake error/timeout. It’s odd really. I followed your steps on securing [Pritunl web service](https://docs.pritunl.com/kb/vpn/security/securing-pritunl#systemd-web-server-process), enabling `Dynamic Client Firewall`, and leaving port 443 to 0.0.0.0/0 via AWS SG. I now begin to see the following on my `pritunl-web.service`: Some additional info: My Wireguard Virtual Gateway is 10.50.0.0/16. Would I need to change my Bind Address? ```shell ssm-user@ip-10-70-11-247:~$ sudo systemctl status pritunl-web.service ● pritunl-web.service Loaded: loaded (/etc/systemd/system/pritunl-web.service; static) Active: active (running) since Tue 2026-01-13 00:47:35 UTC; 5min ago Main PID: 3761009 (pritunl-web) Tasks: 8 (limit: 9206) Memory: 8.1M (peak: 9.5M) CPU: 2.602s CGroup: /system.slice/pritunl-web.service └─3761009 /usr/bin/pritunl-web Jan 13 00:50:46 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:50:46 http: TLS handshake error from 10.50.0.76:43030: EOF Jan 13 00:50:53 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:50:53 http: TLS handshake error from 10.50.0.52:47668: EOF Jan 13 00:50:56 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:50:56 http: TLS handshake error from 10.50.0.76:43032: EOF Jan 13 00:51:02 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:51:02 http: TLS handshake error from 10.50.0.52:47670: EOF Jan 13 00:51:14 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:51:14 http: TLS handshake error from 10.50.0.76:43038: EOF Jan 13 00:51:46 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:51:46 http: TLS handshake error from 10.50.0.76:43040: EOF Jan 13 00:51:56 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:51:56 http: TLS handshake error from 10.50.0.76:43042: EOF Jan 13 00:52:18 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:52:18 http: TLS handshake error from 10.50.0.52:47698: EOF Jan 13 00:52:34 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:52:34 http: TLS handshake error from 10.50.0.66:42754: EOF Jan 13 00:52:49 ip-10-10-11-247 pritunl-web[3761009]: 2026/01/13 00:52:49 http: TLS handshake error from 10.50.0.52:47700: EOF ``` And in the WireGuard client I see this: ```shell Jan 13 10:33:36 d83adddf1ffc pritunl-client-service[380]: profile: Request put error Jan 13 10:33:36 d83adddf1ffc pritunl-client-service[380]: Put “https://10.50.0.1/key/wg/68dcaf7424c8a442639534e5/696161e6d827d0494a8241aa/68dcb16e24c8a442639536ce”: net/http: TLS handshake timeout ``` If I test with `curl` commands, I see the following in the client: ```shell pi@3hhf3k3kj3kk:~ $ curl -k -v https://10.50.0.1/ --connect-timeout 10 * Trying 10.50.0.1... * TCP_NODELAY set * Connected to 10.50.0.1 (10.50.0.1) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * Operation timed out after 10000 milliseconds with 0 out of 0 bytes received * Closing connection 0 curl: (28) Operation timed out after 10000 milliseconds with 0 out of 0 bytes received ``` But if I use `pritunl.foo.com` it works: ```shell pi@3hhf3k3kj3kk:~ $ curl -k -v https://pritunl.foo.com/ --connect-timeout 10 * Trying 18.223.170.186... * TCP_NODELAY set * Connected to pritunl.foo.com (18.223.170.186) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 * ALPN, server accepted to use h2 * Server certificate: * subject: CN=pritunl.foo.com * start date: Dec 21 03:36:35 2025 GMT * expire date: Mar 21 03:36:34 2026 GMT * issuer: C=US; O=Let's Encrypt; CN=E7 * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x32e960) > GET / HTTP/2 > Host: pritunl.foo.com > User-Agent: curl/7.64.0 > Accept: */* > * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * Connection state changed (MAX_CONCURRENT_STREAMS == 250)! < HTTP/2 302 < content-type: text/html; charset=utf-8 < date: Tue, 13 Jan 2026 17:13:20 GMT < location: https://pritunl.foo.com/login < strict-transport-security: max-age=31536000; includeSubDomains < x-content-type-options: nosniff < x-frame-options: DENY < x-robots-tag: noindex < x-xss-protection: 1; mode=block < content-length: 259 < Redirecting...

Redirecting...

You should be redirected automatically to the target URL: https://pritunl.foo.com/login. If not, click the link. * Connection #0 to host pritunl.foo.com left intact ``` I am noticing that this is occurring with a small number of Raspi Pi’s. This is where I’m thinking the Wireguard Ping and Wireguard Ping Timeout can help. I did increase the ping to 60 and the ping timeout to 360. My host settings are like so where `Public Address` is tied to a domain in AWS with the ip address. (For example, I have 2 servers with the same `Sync Address` being [pritunl.foo.com](http://pritunl.foo.com) and the `Public Address` being [pritunl-0.foo.com](http://pritunl-0.foo.com) and [pritunl-1.foo.com](http://pritunl-1.foo.com)). ![image](https://forum-static.pritunl.com/original/2X/b/b5ab5861ebe45223facd83bc8e054442803b3dd7.png) UPDATE FIX: We were able to fix the issue with the Raspi Pis by changing the MTU manually; however, for Enterprise Tunnel MTU is not propagating the 1280 to Wireguard connections. Of what I have read, Pritunl Server uses 1280 for listening but it is our duty to change the Client’s MTU? We are in a predicament especially with Wireguard where Pritunl’s system architecture will reset the connection if a HTTPS handshake is unable to make a connection and resets. If that reset occurs, we would need to change the MTU again everytime. Is the only way to create a cronjob to change the MTU after every reset? ![image](https://forum-static.pritunl.com/original/2X/3/3da5d232ed129d97f6bad920342c95d86dd5fe3b.png) ---

**Author:** ![macsire](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/8e7dd6/32.png) [@macsire](https://forum.pritunl.com/u/macsire)\ **Post date:** [January 14, 2026, 7:10pm UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/2 "2026-01-14T19:10:59Z")
Just to continue from here. Testing with modified MTU 1280 fixes our connections. Just wondering why the Pritunl Server is not propagating the Wireguard MTU to our clients (i.e. Raspi Pis)? Are there specific steps to have the clients have MTU 1280? I see OpenVPN has it in the profile just not Wireguard. Pritunl server version: - v1.32.4400.99 Pritunl client version: - v1.3.4439.70 I have restarted the Pritunl server and still nogo :’( ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 15, 2026, 1:18am UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/3 "2026-01-15T01:18:21Z")
I checked the source code and the MTU values were mixed with the WireGuard configuration. Currently it is using the MSS MTU instead of the Tunnel MTU for WireGuard. You can set the MSS MTU which will then set the WireGuard MTU but if you are also using OpenVPN connections setting both could cause problems. This will be fixed in the next release. ---
**Author:** ![macsire](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/8e7dd6/32.png) [@macsire](https://forum.pritunl.com/u/macsire)\ **Post date:** [January 15, 2026, 1:33am UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/4 "2026-01-15T01:33:22Z")
That did the trick thanks @zach. Currently we have a separate OpenVPN server so all good. We are using Pritunl Wireguard and has shown promise. Just ran into a snag when it came to the MTU. ---
**Author:** ![macsire](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/8e7dd6/32.png) [@macsire](https://forum.pritunl.com/u/macsire)\ **Post date:** [January 15, 2026, 2:25pm UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/5 "2026-01-15T14:25:13Z")
Quick question in Pritunl Wireguard logs on the client side @zach. I am seeing this logs pop up every minute `[INFO] ▶ state: Detected dead state`. It’s not causing any issues but it is an eye sore in our logs. Wondering if this has to do with the Wireguard Ping interval 60 and Wireguard Ping Timeout to 360 I changed. ```shell Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: [2026-01-15 09:12:26][INFO] ▶ state: Detected dead state ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=45034 ◆ data_iface="wg0" ◆ data_mode="" ◆ data_remotes=[]string{"pritunl.foo.com*", "pritunl-1.foo.com", "pritunl-0.foo.com"} ◆ data_status="connected" ◆ data_timestamp=1768441310 ◆ data_tun_iface="" ◆ last_stop_check="2026-01-15 09:11:25" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=false ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=true ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="nfzyi4ghkgu3ytye" ◆ profile_mode="wg" ◆ profile_reconnect=true ◆ profile_sso_auth=false ◆ profile_system_profile=true ◆ profile_timeout=false ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="475031227838a8eb" ◆ state_interactive=false ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{"/etc/wireguard/wg0.conf"} ◆ state_time=time.Date(2026, time.January, 14, 20, 41, 51, 136118347, time.Local) ◆ wg_bash_path="" ◆ wg_conf_path="/etc/wireguard/wg0.conf" ◆ wg_conf_path2="" ◆ wg_connected=true ◆ wg_last_handshake=1768441313 ◆ wg_path="/usr/bin/wg" ◆ wg_priv_key=true ◆ wg_pub_key=true ◆ wg_quick_path="/usr/bin/wg-quick" ◆ wg_server_pub_key=true ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path="" Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*State).IsStop() Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/state.go:118 Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Wg).WatchConnection() Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/wg.go:314 Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start.func1() Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/client.go:220 Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: runtime.goexit() Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: /usr/local/go/src/runtime/asm_arm.s:884 Jan 15 09:12:26 88a29e37cd3d pritunl-client-service[443]: Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: [2026-01-15 09:13:27][INFO] ▶ state: Detected dead state ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=45095 ◆ data_iface="wg0" ◆ data_mode="" ◆ data_remotes=[]string{"pritunl.foo.com*", "pritunl-1.foo.com", "pritunl-0.foo.com"} ◆ data_status="connected" ◆ data_timestamp=1768441310 ◆ data_tun_iface="" ◆ last_stop_check="2026-01-15 09:12:26" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=false ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=true ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="nfzyi4ghkgu3ytye" ◆ profile_mode="wg" ◆ profile_reconnect=true ◆ profile_sso_auth=false ◆ profile_system_profile=true ◆ profile_timeout=false ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="475031227838a8eb" ◆ state_interactive=false ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{"/etc/wireguard/wg0.conf"} ◆ state_time=time.Date(2026, time.January, 14, 20, 41, 51, 136118347, time.Local) ◆ wg_bash_path="" ◆ wg_conf_path="/etc/wireguard/wg0.conf" ◆ wg_conf_path2="" ◆ wg_connected=true ◆ wg_last_handshake=1768441313 ◆ wg_path="/usr/bin/wg" ◆ wg_priv_key=true ◆ wg_pub_key=true ◆ wg_quick_path="/usr/bin/wg-quick" ◆ wg_server_pub_key=true ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path="" Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*State).IsStop() Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/state.go:118 Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Wg).WatchConnection() Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/wg.go:314 Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start.func1() Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/client.go:220 Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: runtime.goexit() Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: /usr/local/go/src/runtime/asm_arm.s:884 Jan 15 09:13:27 88a29e37cd3d pritunl-client-service[443]: Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: [2026-01-15 09:14:29][INFO] ▶ state: Detected dead state ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=45157 ◆ data_iface="wg0" ◆ data_mode="" ◆ data_remotes=[]string{"pritunl.foo.com*", "pritunl-1.foo.com", "pritunl-0.foo.com"} ◆ data_status="connected" ◆ data_timestamp=1768441310 ◆ data_tun_iface="" ◆ last_stop_check="2026-01-15 09:13:28" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=false ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=true ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="nfzyi4ghkgu3ytye" ◆ profile_mode="wg" ◆ profile_reconnect=true ◆ profile_sso_auth=false ◆ profile_system_profile=true ◆ profile_timeout=false ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="475031227838a8eb" ◆ state_interactive=false ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{"/etc/wireguard/wg0.conf"} ◆ state_time=time.Date(2026, time.January, 14, 20, 41, 51, 136118347, time.Local) ◆ wg_bash_path="" ◆ wg_conf_path="/etc/wireguard/wg0.conf" ◆ wg_conf_path2="" ◆ wg_connected=true ◆ wg_last_handshake=1768441313 ◆ wg_path="/usr/bin/wg" ◆ wg_priv_key=true ◆ wg_pub_key=true ◆ wg_quick_path="/usr/bin/wg-quick" ◆ wg_server_pub_key=true ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path="" Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*State).IsStop() Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/state.go:118 Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Wg).WatchConnection() Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/wg.go:314 Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start.func1() Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/client.go:220 Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: runtime.goexit() Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: /usr/local/go/src/runtime/asm_arm.s:884 Jan 15 09:14:29 88a29e37cd3d pritunl-client-service[443]: Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: [2026-01-15 09:15:31][INFO] ▶ state: Detected dead state ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=45219 ◆ data_iface="wg0" ◆ data_mode="" ◆ data_remotes=[]string{"pritunl.foo.com*", "pritunl-1.foo.com", "pritunl-0.foo.com"} ◆ data_status="connected" ◆ data_timestamp=1768441310 ◆ data_tun_iface="" ◆ last_stop_check="2026-01-15 09:14:30" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=false ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=true ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="nfzyi4ghkgu3ytye" ◆ profile_mode="wg" ◆ profile_reconnect=true ◆ profile_sso_auth=false ◆ profile_system_profile=true ◆ profile_timeout=false ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="475031227838a8eb" ◆ state_interactive=false ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{"/etc/wireguard/wg0.conf"} ◆ state_time=time.Date(2026, time.January, 14, 20, 41, 51, 136118347, time.Local) ◆ wg_bash_path="" ◆ wg_conf_path="/etc/wireguard/wg0.conf" ◆ wg_conf_path2="" ◆ wg_connected=true ◆ wg_last_handshake=1768441313 ◆ wg_path="/usr/bin/wg" ◆ wg_priv_key=true ◆ wg_pub_key=true ◆ wg_quick_path="/usr/bin/wg-quick" ◆ wg_server_pub_key=true ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path="" Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*State).IsStop() Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/state.go:118 Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Wg).WatchConnection() Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/wg.go:314 Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start.func1() Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/client.go:220 Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: runtime.goexit() Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: /usr/local/go/src/runtime/asm_arm.s:884 Jan 15 09:15:31 88a29e37cd3d pritunl-client-service[443]: Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: [2026-01-15 09:16:33][INFO] ▶ state: Detected dead state ◆ client_disconnect=false ◆ client_disconnect_waiters=0 ◆ client_disconnected=false ◆ client_provider=true ◆ client_startime=45281 ◆ data_iface="wg0" ◆ data_mode="" ◆ data_remotes=[]string{"pritunl.foo.com*", "pritunl-1.foo.com", "pritunl-0.foo.com"} ◆ data_status="connected" ◆ data_timestamp=1768441310 ◆ data_tun_iface="" ◆ last_stop_check="2026-01-15 09:15:32" ◆ ovpn_auth_failed=false ◆ ovpn_cmd=false ◆ ovpn_connected=false ◆ ovpn_dir="" ◆ ovpn_last_auth_failed=-1 ◆ ovpn_management_pass=false ◆ ovpn_management_port=0 ◆ ovpn_path="openvpn" ◆ ovpn_remotes=[]string{} ◆ ovpn_running=0 ◆ ovpn_tap_iface="" ◆ profile_device_auth=false ◆ profile_disable_dns=false ◆ profile_disable_gateway=false ◆ profile_dynamic_firewall=true ◆ profile_force_connect=false ◆ profile_force_dns=false ◆ profile_geo_sort=false ◆ profile_id="nfzyi4ghkgu3ytye" ◆ profile_mode="wg" ◆ profile_reconnect=true ◆ profile_sso_auth=false ◆ profile_system_profile=true ◆ profile_timeout=false ◆ state_closed=false ◆ state_closed_waiters=0 ◆ state_deadline=false ◆ state_delay=false ◆ state_id="475031227838a8eb" ◆ state_interactive=false ◆ state_no_reconnect=false ◆ state_stop=false ◆ state_system_interactive=false ◆ state_temp_paths=[]string{"/etc/wireguard/wg0.conf"} ◆ state_time=time.Date(2026, time.January, 14, 20, 41, 51, 136118347, time.Local) ◆ wg_bash_path="" ◆ wg_conf_path="/etc/wireguard/wg0.conf" ◆ wg_conf_path2="" ◆ wg_connected=true ◆ wg_last_handshake=1768441313 ◆ wg_path="/usr/bin/wg" ◆ wg_priv_key=true ◆ wg_pub_key=true ◆ wg_quick_path="/usr/bin/wg-quick" ◆ wg_server_pub_key=true ◆ wg_sso_start=time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC) ◆ wg_sso_token=false ◆ wg_util_path="" Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*State).IsStop() Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/state.go:118 Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Wg).WatchConnection() Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/wg.go:314 Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: github.com/pritunl/pritunl-client-electron/service/connection.(*Client).Start.func1() Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: /root/go/pkg/mod/github.com/pritunl/pritunl-client-electron/service@v0.0.0-20251107165148-bbdc2c1ed308/connection/client.go:220 Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: runtime.goexit() Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: /usr/local/go/src/runtime/asm_arm.s:884 Jan 15 09:16:33 88a29e37cd3d pritunl-client-service[443]: ``` ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 15, 2026, 4:57pm UTC](https://forum.pritunl.com/t/wireguard-connection-giving-tls-handshake-timeout/3682/6 "2026-01-15T16:57:41Z")
I may adjust that in a future release but if the ping interval gets close to or above 60 seconds that will be shown. It occurs when the state hasn’t been checked for 60 seconds, this was added to detect deadlocks that had occurred in past releases.