An option to quickly disable all non-PFE ciphers?

catBot

I know about the --tls-cipher l.

To avoid a mistake with creating an allowed list manually - is there an option to disable all non-PFE ciphers?

JoshC

No, not really. As of recent releases the "OpenSSL TLS cipher-suite" options are deprecated and you should be using the IANA names for ciphers.

You might want to review the wiki document on OpenVPN hardeningas it gives you a nice run-down of using --tls-cipher securely.