goofy79 Hello, i'm using openVPN 2.2.1 and i have a lot of client all over the world. in my config i have the standard cipher BF-CBC. now my problem, i want to change the ciphre to AES-256-CBC but i can't change all the config of my devices at the same time. So the best way for me will be, that the Server support multiple cipher and i can change the cipher step-by-step. Is there a solution for me ?
TinCanTech goofy79 wrotei'm using openVPN 2.2.1Is that OpenVPN-Access.Server or OpenVPN-Community.Edition ?
TinCanTech So you mean OpenVPN-Community.Edition ? Check your log file please. Also, Please see: HOWTO: Request Help !
goofy79 sorry, i don't understand - can you tell me the dependency to the Edition ? I want to ask this in general ? Is it principiell possible or what do i need for this ? But i think i have the OpenVPN Community Edition - because i installed it with "apt-get install openvpn-server" ?
TinCanTech If it is Openvpn-Community.Edition 2.4_beta2 he could ..goofy79 wrotebecause i installed it with "apt-get install openvpn-server"But we just don't know what it is .. :geek:
goofy79 OK, so i think it is not matter what i have - because i'm able to update my Server without any problems 😉 So do you think, the Openvpn-Community.Edition 2.4_beta2 can manage it ? Can somebody tell me the parameter to try this ?
goofy79 OK, with the 2.4 rc1 Community Edition it seems to work. i add to my config cipher BF-CBC cipher AES-256-CBC and now clients with BF-CBC and clients with AES-256-CBC can connect to the server 😃 Many thanks for your help !
Billyboy996 Does this work as well with together with "cipher none"? I need to allow either an encrypted session or an unencrypted in the same instance. I am worrying, if the "cipher non" command completely disables all the encryption an the "cipher BF-CBC" then doesn´t work because of the general disabled encryption. So, does: cipher none cipher BF-CBC work? I searched all over, but I haven´t found an answer. Kind regards in advance!
The Johan In theory null is a valid name so I guess so yeah, if the server supports negotiable crypto parameters.
TinCanTech Billyboy996 wrote So, does: cipher none cipher BF-CBC work? If you put that into an openvpn (Free version) server config file in that order then all you are doing is enabling cipher BF-CBC for all connections.
The Johan Good catch. Yeah you need to use the new NCP parameter to specify multiple ciphers. Just repeating the cipher directive means the last one takes.
Billyboy996 Did i get it right now? For the new version it has to look like: cipher BF-CBC ncp-ciphers none and for the older version like that: cipher BF-CBC cipher none Is that correct?
The Johan No, the older version of OpenVPN, like version 2.3, simply does not support multiple ciphers. At all. It's completely impossible. You can only use one cipher for the server and all the clients on OpenVPN 2.3. NCP was added to 2.4 and it makes negotiating ciphers possible. You set one default cipher, and you can add ciphers on top of that, that are also allowed. In that case yeah something like cipher BF-CBC and ncp-ciphers AES-256-CBC are the way to do it. And I'm guessing null is also a valid 'cipher' to use.
