Bug description
server.conf.j2 (line 6) and client.conf.j2 (line 3) set tls-cipher TLS-RSA-WITH-AES-256-GCM-SHA384:TLS-RSA-WITH-AES-256-CBC-SHA256:TLS-RSA-WITH-AES-256-CBC-SHA. openvpn --show-tls lists none of these three suites, neither on Rocky 9 (openvpn 2.5.11) nor on Rocky 10 (openvpn 2.7.6). They use static RSA key exchange without forward secrecy, which current OpenSSL no longer offers.
Steps to reproduce
- Install openvpn from EPEL on Rocky 9 or Rocky 10.
- Run
openvpn --show-tls | grep -c TLS-RSA-WITH, which prints 0.
Expected behavior
Either no tls-cipher line, leaving the choice to openvpn and the crypto policy, or a list of suites that exist and provide forward secrecy.
Environment
LFOps main; openvpn 2.5.11 (EPEL 9) and 2.7.6 (EPEL 10).
Additional context
Connections presumably work today only because tls-cipher governs TLS 1.2 and below while both ends negotiate TLS 1.3. That part is not measured, since a live handshake needs /dev/net/tun. A peer limited to TLS 1.2 would find no common suite.
Bug description
server.conf.j2(line 6) andclient.conf.j2(line 3) settls-cipher TLS-RSA-WITH-AES-256-GCM-SHA384:TLS-RSA-WITH-AES-256-CBC-SHA256:TLS-RSA-WITH-AES-256-CBC-SHA.openvpn --show-tlslists none of these three suites, neither on Rocky 9 (openvpn 2.5.11) nor on Rocky 10 (openvpn 2.7.6). They use static RSA key exchange without forward secrecy, which current OpenSSL no longer offers.Steps to reproduce
openvpn --show-tls | grep -c TLS-RSA-WITH, which prints0.Expected behavior
Either no
tls-cipherline, leaving the choice to openvpn and the crypto policy, or a list of suites that exist and provide forward secrecy.Environment
LFOps main; openvpn 2.5.11 (EPEL 9) and 2.7.6 (EPEL 10).
Additional context
Connections presumably work today only because
tls-ciphergoverns TLS 1.2 and below while both ends negotiate TLS 1.3. That part is not measured, since a live handshake needs/dev/net/tun. A peer limited to TLS 1.2 would find no common suite.