fjor
Hi,
I hope someone can help. I am currently using OpenVPN 2.3.4 and want to configure it to support TLS 1.2. Has anyone successfully configured this and if so, would you share your configuration file and setup experience?
Thank you.
fjor
Yes I have added "tls-version-min 1.2" in both the client and server config files. The server was up and running fine. However, every time when the client starts to connect, the server crashed. Below is the error in the log file:
========================= Begin Error Log =====================
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
Assertion failed!
Program: C:\Program Files\OpenVPN\bin\openvpn.exe
File: cryptoapi.c, Line 263
Expression: 0
========================= End Error Log =====================
Below is the server config:
========================= Begin Server Config =====================
port 1194
proto udp
dev tap
ca "C:\\Program Files\\OpenVPN\\certs\\dev.vpn.com CA public certificate SHA256.cer"
dh "C:\\Program Files\\OpenVPN\\certs\\dh2048.pem"
cryptoapicert "THUMB:61 8a da fc ec 5c 70 84 21 ed 2c dd c2 c0 2a 3b f6 f7 f5 69"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist "C:\\Program Files\\OpenVPN\\config\\ipp.txt"
client-to-client
keepalive 10 120
tls-server
cipher AES-256-CBC
keysize 256
auth SHA256
comp-lzo
persist-key
persist-tun
verb 6
tls-version-min 1.2
tls-cipher "TLS-RSA-WITH-AES-256-CBC-SHA256"
========================= End Server Config =====================
Below is the client config:
========================= Begin Client Config =====================
client
dev tap
proto udp
remote HELLO-SRV64 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\certs\\dev.vpn.com CA public certificate SHA256.cer"
cert "C:\\Program Files\\OpenVPN\\certs\\hello-cli32.dev.vpn.com cert SHA256.cer"
key "C:\\Program Files\\OpenVPN\\certs\\hello-cli32.dev.vpn.com cert private key SHA256.key"
tls-remote HELLO-SRV64.dev.vpn.com
tls-client
cipher AES-256-CBC
keysize 256
auth SHA256
comp-lzo
verb 6
tls-version-min 1.2
tls-cipher "TLS-RSA-WITH-AES-256-CBC-SHA256"
========================= End Client Config =====================
fjor
Thank you very much for your response.
We have a requirement in our environment not to enable export of private key for server certificates. Is there anyway to meet this requirement within the TLS 1.2 setup in OpenVPN?
Regards
fjor
Just curious. What is the reason that the "cryptoapicert" does not support TLS 1.2 currently? Is it due to the version of Microsoft's CryptoAPI that is being used?
