Security settings with compatibility in mind

ternarybit

Hi all,

First, please forgive me if this is a well-beaten dead horse. I ran a few searches and didn't find anything.

I have OpenVPN set up and working well for myself and a pilot user for a small NPO. Before I roll out client configs to the other users, I want to be *sure* I have this set up correctly, so I won't have to backtrack and touch every client again.

I started this deployment just tinkering, so I enabled AES-256-CBC and SHA-256--almost certainly overkill for this use case. But if the added security comes with little or no penalty, I'll take it. I don't have the resources to test every platform available, so I thought I'd ask:

What security settings (ciphersuite and hash function) do you recommend, as a reasonable compromise between security, compatibility and performance?
Can I declare a list of acceptable ciphersuites/hash functions on the server, from which the client will automatically negotiate the most secure option it supports?
Anything else I should pay attention to for compatibility's sake?

Thanks!