Access Server: “TLS Error: incoming packet authentication failed” when pfSense connects using TLS Auth

Overview

When a pfSense OpenVPN client attempts to connect to Access Server using TLS Auth, the connection may fail. Access Server may report a TLS control-channel authentication error similar to this:

2026-07-02T16:07:37+0100 [stdout#info] [OVPN 1] OUT: '2026-07-02 15:07:37 TLS Error: incoming packet authentication failed from [AF_INET]x.x.x.x:5779 (via [AF_INET]172.31.1.54%[undef])'

Cause

This issue can occur when the Auth Digest Algorithm configured for the pfSense OpenVPN client doesn’t match the digest expected by the Access Server TLS Auth configuration.

In the tested configuration, pfSense used SHA256 for the Auth Digest Algorithm, and the connection failed with this error:

TLS Error: incoming packet authentication failed

Changing the pfSense Auth Digest Algorithm from SHA256 to SHA1 resolved the issue.

Resolution

To change the Auth Digest Algorithm in pfSense:

1. Sign in to the pfSense Web UI.
2. Go to VPN > OpenVPN.
3. Select the Clients tab.
4. Edit the OpenVPN client configuration used to connect to Access Server.
5. Locate Auth Digest Algorithm in the cryptographic settings.
6. Change Auth Digest Algorithm from SHA256 to SHA1.
7. Click Save and apply the changes.
8. Restart or reconnect the OpenVPN client.

After making the change, verify that the client connects successfully and that Access Server no longer reports this error:

TLS Error: incoming packet authentication failed

If you have additional questions or encounter an issue, submit a support ticket.