Summary:
Are the results of available ciphers that I see from the CLI the same as what will be available to the openvpn service when it is offering service even though these errors/warnings appear in the openvpn log?
Fri Dec 16 18:01:56 2016 Deprecated TLS cipher name 'HIGH', please use IANA name 'HIGH'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!SHA'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!MD5'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!AES128'
Details:
Hello,
In looking over inclusion of restrictions of tls-ciphers, I found a path that seemed that it would help:
From the command line:
# openvpn --tls-cipher 'HIGH:!SHA:!MD5:!AES128' --show-tls |less
I could call that and change the arg to "--tls-cipher" review the results and see what was left.
That example effectively removes those tls-ciphers using SHA1, and MD5, and AES128/AES-128 showing me:
Fri Dec 16 18:01:56 2016 Deprecated TLS cipher name 'HIGH', please use IANA name 'HIGH'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!SHA'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!MD5'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!AES128'
Available TLS Ciphers,
listed in order of preference:
TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384
TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384
TLS-DHE-DSS-WITH-AES-256-GCM-SHA384
TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
TLS-DHE-DSS-WITH-AES-256-CBC-SHA256
ADH-AES256-GCM-SHA384 (No IANA name known to OpenVPN, use OpenSSL name.)
ADH-AES256-SHA256 (No IANA name known to OpenVPN, use OpenSSL name.)
TLS-ECDH-RSA-WITH-AES-256-GCM-SHA384
TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384
TLS-ECDH-RSA-WITH-AES-256-CBC-SHA384
TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384
TLS-RSA-WITH-AES-256-GCM-SHA384
TLS-RSA-WITH-AES-256-CBC-SHA256
Be aware that that whether a cipher suite in this list can actually work
depends on the specific setup of both peers. See the man page entries of
--tls-cipher and --show-tls for more details.
The top 4 lines suggest there were problems with the "!" blacklisting, but the results of available ciphers after including the limits ('HIGH:!SHA:!MD5:!AES128') seems to have removed the items I wanted removed.
Fri Dec 16 18:01:56 2016 Deprecated TLS cipher name 'HIGH', please use IANA name 'HIGH'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!SHA'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!MD5'
Fri Dec 16 18:01:56 2016 No valid translation found for TLS cipher '!AES128'
When I include this in my server's OpenVPN config,
tls-cipher 'HIGH:!SHA:!MD5:!AES128'
and then start it and inspect its log, I see the same "warning" (errors?):
Fri Dec 16 17:50:00 2016 us=516701 Diffie-Hellman initialized with 4096 bit key
Fri Dec 16 17:50:00 2016 us=518038 Deprecated TLS cipher name 'HIGH', please use IANA name 'HIGH'
Fri Dec 16 17:50:00 2016 us=518078 No valid translation found for TLS cipher '!SHA'
Fri Dec 16 17:50:00 2016 us=518105 No valid translation found for TLS cipher '!MD5'
Fri Dec 16 17:50:00 2016 us=518132 No valid translation found for TLS cipher '!AES128'
When I run it (openvpn --tls-cipher 'HIGH:!SHA:!MD5:!AES128' --show-tls) without the tls-cipher limits (# openvpn --tls-cipher --show-tls) I see several tls-ciphers with SHA(1), one with MD5, and several that use AES-128 or AES128, so it seems like it is working from the command line even with the warning/error.
So, are these errors or warnings when the service is actually running:
Fri Dec 16 17:50:00 2016 us=516701 Diffie-Hellman initialized with 4096 bit key
Fri Dec 16 17:50:00 2016 us=518038 Deprecated TLS cipher name 'HIGH', please use IANA name 'HIGH'
Fri Dec 16 17:50:00 2016 us=518078 No valid translation found for TLS cipher '!SHA'
Fri Dec 16 17:50:00 2016 us=518105 No valid translation found for TLS cipher '!MD5'
Fri Dec 16 17:50:00 2016 us=518132 No valid translation found for TLS cipher '!AES128'
Are the results of available ciphers that I see from the commandline the same as what will be available to the openvpn service when it is offering service?
It looks like these are just warnings, informing me that there were not explicit matches for those items (de)-selected, and no mapping for those (as shortcuts/abbreviations) to the full name of the tls-ciphers.
I'd just like to confirm that this is really a warning and not an error and the list I see from the command line is the same as the service is offering.
Thanks!
-SomeGuy
