Tilius
Hello,
I setup an openvpn instance in a freebsd jail, server version is 2.3.6
client is on windows, version is 2.3.6 (doesn't really matter with my issue)
everything is working fine, but i notice in client logs the following things :
Sun Mar 08 11:37:47 2015 us=540358 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 256 bit key
Sun Mar 08 11:37:47 2015 us=540358 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Mar 08 11:37:47 2015 us=540358 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 256 bit key
Sun Mar 08 11:37:47 2015 us=540358 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Mar 08 11:37:47 2015 us=540358 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
As far as i know TLSv1/SSLv3 is not secure. i search a bit and i find that i could use "tls-version-min 1.2" to force using a more uptodate tls version.
the point is that, as soon as put this in my server conf file (openvpn.conf) i can't start openvpn anymore, i get :
Starting openvpn.
/usr/local/etc/rc.d/openvpn: WARNING: failed to start openvpn
the server config file is :
port 443
proto tcp
dev tun
ca /mnt/keys/ca.crt
cert /mnt/keys/openvpn-server.crt
key /mnt/keys/openvpn-server.key
dh /mnt/keys/dh4096.pem
server 192.168.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
route 192.168.1.102 255.255.255.0 192.168.2.1
#tls-auth /mnt/keys/auth.key
#crl-verify /mnt/keys/crl.pem
keepalive 10 120
group nobody
user nobody
comp-lzo
tls-version-min 1.2
persist-key
persist-tun
push "redirect-gateway"
push "dhcp-option DNS 192.168.1.1"
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
if i remove the tls-version-min line it start perfectly.
it seems this conf line is widely used, so what is the facepalm ?
best regards,
