[Solved]Can't start server with tls-version-min 1.2

jasmin

Hello =)

I'm new to openvpn and I'm trying to run a server with TLSv1.2. But when I try to start the server with the option 'tls-version-min 1.2' it won't start. Without this option everything works fine but only with TLSv1.0-connections.
I can't post an error-log because the file is empty.

server.conf

port 1194 
proto tcp 
dev tun 

ca ca.crt 
cert server.crt 
key server.key 

tls-version-min 1.2 

dh dh2048.pem 

server 10.8.0.0 255.255.255.0 
ifconfig-pool-persist 
ipp.txt keepalive 10 120 

comp-lzo 
max-clients 100 
persist-key 
persist-tun 
status openvpn-status.log 
log openvpn.log 
verb 3

Server side:
openssl version
OpenSSL 1.0.1f 6 Jan 2014

openvpn --version
OpenVPN 2.3.6 x86_64-unknown-linux-gnu
library versions: OpenSSL 1.0.1f

Many greetings,
Jasmin

maikcat

which OS do you use?

you can also use openvpn --config configfle to start openvpn and see messages as it comes up...

Michael.

jasmin

I'm using Linux Ubuntu Server 14.04.2 64-Bit.

Finally I could find this in the syslog:

May  7 08:44:20 freya ovpn-server[1215]: Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/server.conf:69: tls-version-min (2.3.2)
May  7 08:44:20 freya ovpn-server[1215]: Use --help for more information.

I'm using OpenVPN 2.3.6, installed from source and I thougt it should support the option tls-version-min?
When I start the config without this option, I'm not able to use TLSv1.2 ciphers.

When I start openvpn --config server.conf, this is the output in the openvpn.log:

Thu May  7 09:17:53 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May  6 2015
Thu May  7 09:17:53 2015 library versions: OpenSSL 1.0.1f 6 Jan 2014, LZO 2.06
Thu May  7 09:17:53 2015 Diffie-Hellman initialized with 2048 bit key
Thu May  7 09:17:53 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu May  7 09:17:53 2015 ROUTE_GATEWAY 192.168.178.1/255.255.255.0 IFACE=eth0 HWADDR=08:00:27:c6:6b:b7
Thu May  7 09:17:53 2015 TUN/TAP device tun0 opened
Thu May  7 09:17:53 2015 TUN/TAP TX queue length set to 100
Thu May  7 09:17:53 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May  7 09:17:53 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu May  7 09:17:53 2015 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu May  7 09:17:53 2015 Listening for incoming TCP connection on [undef]
Thu May  7 09:17:53 2015 TCPv4_SERVER link local (bound): [undef]
Thu May  7 09:17:53 2015 TCPv4_SERVER link remote: [undef]
Thu May  7 09:17:53 2015 MULTI: multi_init called, r=256 v=256
Thu May  7 09:17:53 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu May  7 09:17:53 2015 ifconfig_pool_read(), in='tool,10.8.0.4', TODO: IPv6
Thu May  7 09:17:53 2015 succeeded -> ifconfig_pool_set()
Thu May  7 09:17:53 2015 IFCONFIG POOL LIST
Thu May  7 09:17:53 2015 tool,10.8.0.4
Thu May  7 09:17:53 2015 MULTI: TCP INIT maxclients=100 maxevents=104
Thu May  7 09:17:53 2015 Initialization Sequence Completed
Thu May  7 09:21:35 2015 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Thu May  7 09:21:35 2015 Closing TUN/TAP interface
Thu May  7 09:21:35 2015 /sbin/ifconfig tun0 0.0.0.0
Thu May  7 09:21:35 2015 SIGINT[hard,] received, process exiting

maikcat

Thu May 7 09:17:53 2015 MULTI: TCP INIT maxclients=100 maxevents=104
Thu May 7 09:17:53 2015 Initialization Sequence Completed

this shows that server is up and running....

the option works as i use it myself 😉

Michael.

jasmin

I'm just stupid ... :roll: I had an older openvpn version installed and started with "start service openvpn" ... That's the reason for the output in the syslog...
With "openvpn --config server.conf" everything is fine. It's very embarrassing to say, I've just killed the server everytime, because in this case I've only a single console ... Now its running in the backround. :lol:

Thank you very much for your help!

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.