tls-server
dev tun
server 10.42.0.0 255.255.248.0
proto udp
port 80
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384,ECDHE-RSA-CHACHA20-POLY1305
tls-version-min 1.2
cipher AES-256-CBC
auth sha256
ca "/etc/openvpn/public/Server+Authority.crt" # Server Intermediate certificate
cert "/etc/openvpn/public/Server1.crt" # Server certificate
dh "/etc/openvpn/public/dh1024.pem" # Diffie Helman 2048 or 4096.pem( it is 1024 here for testing purposes)
key "/etc/openvpn/secret/Server1.key" # Server secret key
tls-auth "/etc/openvpn/secret/ta.key" 0 # HMAC 0 for server 1 client
reneg-sec 3600
hand-window 60
tran-window 3600
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.42.78.3"
push "dhcp-option DNS 10.42.78.4"
tun-mtu 1419
fragment 1415
mssfix
replay-window 64 [15]
mute-replay-warnings
replay-persist replay.txt
ns-cert-type client
prng sha256 32
user nobody
group nobody
chroot /jail/servervpn1/
persist-key
persist-tun
keepalive 10 60
fast-io
comp-lzo adaptive
max-clients 100
verb 4
mute 20
There is anything anyone would do different ? How do i know which elliptic curve is being used in ECDHE(I really don't want any NIST curve to be used)?
About
prng sha256 32
should i use sha512 64 ? Would it be more secure? Changed it because i don't like the SHA-1 default configuration.
There is any harm in the chroot /jail being owned by the same User and Group as the OpenVPN? There is any harm in keeping different server instances (e.g port 80 and 443 servers) on the same chroot /jail, but one inside /jail/server1 and /jail/server2? The ideia is that if one server is compromised then it should not compromise others.
About static key , even OpenVPN admit "Also, because of the potential weakness of static keys, you should rotate them on a timetable, such as weekly or monthly." So the question is how do i push on the fly the new static key to clients? They wouldn't like to download a new client.conf every month.
My public key infrastructure is Root CA > Server Authority (Intermediate) > Client Authority (Intermediate) > ServerX (signed by Server Authority) > ClientX (Signed by Client Authority)
So far OpenVPN is not complaining if i only provide Server Authority in :
ca "/etc/openvpn/public/Server+Authority.crt" # Server Intermediate certificate
Should i do this different? I would expect a chain error from OpenVPN but nothing. How do I build the chain so OpenVPN can check that the server certificate was signed by the intermediate certificate that was signed by the root CA? I don't want to keep the root CA keys on server either. I also want to rotate the Server certificate monthly or at least every 2 months, how can i make that without annoying my users?
Also what exactly this message means when i run test mode for server :
No valid translation found for TLS cipher 'TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384,ECDHE-RSA-CHACHA20-POLY1305'
So far OpenVPN seems to ignore my prng sha directive because its using :
PRNG init md=SHA256 size=64
