As starting with 2.4 elliptic crypto is supported I decided to give it a try. After some digging and researching I manage to make it work. Please note that you will need 2.4 capable server and client together with latest crypto libraries. In my case I used raspberry pi with raspbian jessie as a server and macOS with the latest tunnelblick beta 3.6.10beta06 (only this one supports OpenVPN 2.4 at the moment) as a client. On my pi I have installed the latest openssl 1.0.1j (needed for easy-rsa and some manual operations) and mbedTLS 2.4.0 for OpenVPN server: *** openssl https://www.openssl.org/source/openssl-1.0.2j.tar.gz tar xvf openssl-1.0.2j.tar.gz cd openssl-1.0.2j ./config make sudo install *** mbedtls wget https://tls.mbed.org/download/mbedtls-2.4.0-gpl.tgz tar xvf mbedtls-2.4.0-gpl.tgz cd mbedtls-2.4.0/ make sudo make install Then I have built the latest OpenVPN 2.4 wget https://swupdate.openvpn.org/community/releases/openvpn-2.4.0.tar.gz tar xvf openvpn-2.4.0.tar.gz cd openvpn-2.4.0 ./configure --with-crypto-library=mbedtls make sudo make install As manual installation does not replace openvpn software which comes with raspberry pi please be careful which version you run. For testing I would recommend just run it from command like openvpn --config server_ecc.conf When you are happy with results you can tinker with systemd or initd to make 2.4 your default autostart option. Now time to generate our EC keys. The easiest way is to use easy-rsa cd ~ mkdir OPENVPN cd OPENVPN git clone git://github.com/OpenVPN/easy-rsa cd easy-rsa/easyrsa3 cp vars.example vars # edit vars - see my example file below. Make sure you point openssl to the latest one # my vars file BEGIN ------------ set_var EASYRSA "$PWD" # make sure that it points to your latest openssl file set_var EASYRSA_OPENSSL "/usr/local/openssl/bin/openssl" set_var EASYRSA_PKI "$EASYRSA/pki" set_var EASYRSA_DN org set_var EASYRSA_REQ_COUNTRY "US" set_var EASYRSA_REQ_PROVINCE "California" set_var EASYRSA_REQ_CITY "San Francisco" set_var EASYRSA_REQ_ORG "Copyleft Certificate Co" set_var EASYRSA_REQ_EMAIL "me@example.net" set_var EASYRSA_REQ_OU "My Organizational Unit" # !!! going elliptic crypto mode. Yipie [b]set_var EASYRSA_ALGO ec[/b] # Define the named curve - choose what you like and what is supported - openvpn --show-curves [b]set_var EASYRSA_CURVE secp521r1[/b] # In how many days should the root CA key expire? set_var EASYRSA_CA_EXPIRE 3650 # In how many days should certificates expire? set_var EASYRSA_CERT_EXPIRE 3650 # How many days until the next CRL publish date? Please note that 2.4 takes seriously next crl publish date and dont run if it expires. If you use setup from 2.3 you might have to recreate crl files. you can check your crl with openssl crl -in crl.pem -noout -text set_var EASYRSA_CRL_DAYS 3650 # my vars file END ------------ # create new PKI ./easyrsa init-pki # build CA ./easyrsa build-ca # create server cert ./easyrsa gen-req myECserver nopass # sign server cert ./easyrsa sign-req server myECserver #create user cert ./easyrsa gen-req ECClient1 # sign user cert ./easyrsa sign-req client ECClient1 go to ./pki/private folder and 3DES encrypt your private key. again - make sure you are using the latest openssl. I am not 100% sure if this step is required for all clients. /usr/local/ssl/bin/openssl ec -in ECClient1.key -des3 -out ECClient1.3des.key Now you have all server files. ./pki/ca.crt ./pki/issued/myECserver.crt ./pki/private/myECserver.key Copy them to your openvpn server config folder. I put them in separate folder /etc/openvpn/ECCkeys and use these client files to create ovpn file: ./pki/ca.crt - use for value in your ovpn file ./pki/issued/ECClient1.crt - use for value (only part between BEGIN and END) ./pki/private/ECClient1.3des.key - use for value Please see below my ovpn example file. This is an example with real data - of course I don't use it any more so don't waste time cracking it:) I have commented out all non essential parameters. If you make it working you can uncomment whatever you think is useful for you. But why to complicate things from the start... [oconf=client]client dev tun remote myserver.com 1194 udp #float #resolv-retry infinite #nobind #persist-key #persist-tun #mute-replay-warnings #cipher AES-256-GCM #auth SHA512 #key-direction 1 #reneg-sec 0 #compress lz4 #verb 3 #mute 20 #remote-cert-tls server #remote-cert-eku "TLS Web Server Authentication" #verify-x509-name DB-OpenVPN-Server name -----BEGIN CERTIFICATE----- MIIEDzCCA3CgAwIBAgIJAPExRQl9wMeRMAoGCCqGSM49BAMCMIGyMQswCQYDVQQG EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj bzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlmaWNhdGUgQ28xHzAdBgNVBAsMFk15 IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNVBAMMC0Vhc3ktUlNBIENBMR0wGwYJ KoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDAeFw0xNzAxMTYwOTE0MDJaFw0yNzAx MTQwOTE0MDJaMIGyMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEW MBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlm aWNhdGUgQ28xHzAdBgNVBAsMFk15IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNV BAMMC0Vhc3ktUlNBIENBMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDCB mzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAWGwh3oYzUzpVX7qyqO4A0ygo834d4eZ 2ZPHOYoxZRdBieQv51pCY6hZl/6/qlcUl8pKqn7mDWH9ySIIiqz0X8QTAM6XSH8H at/thQPZt5o6sRrJqrBCuX0h8lZs0QWIRs4od0442NQIJ7spu5MIYXCoycuoZm+b RGocerRG6Mmt0G3Mo4IBKDCCASQwHQYDVR0OBBYEFEo9zHVMOGgBkSyHb64NgSeC ERbSMIHnBgNVHSMEgd8wgdyAFEo9zHVMOGgBkSyHb64NgSeCERbSoYG4pIG1MIGy MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2Fu IEZyYW5jaXNjbzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlmaWNhdGUgQ28xHzAd BgNVBAsMFk15IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNVBAMMC0Vhc3ktUlNB IENBMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldIIJAPExRQl9wMeRMAwG A1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMAoGCCqGSM49BAMCA4GMADCBiAJCAKWu xGrpBfNnKpTOSCG0P9veO1SO86HUuRubTYtf66RNjH+K4PV1DT2z65FwN42VvAK/ M3by41KiHGDxZvupOtNCAkIBbXJkDU6NHNcX7fMwD0TpjThi8Iim0PKATuT32CcK nM5BwY5HsNhnomYNWo74hZ9oUUJi+upkaqSzYtNJJboPzZ0= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEGDCCA3mgAwIBAgIBATAKBggqhkjOPQQDAjCBsjELMAkGA1UEBhMCVVMxEzAR BgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xIDAeBgNV BAoMF0NvcHlsZWZ0IENlcnRpZmljYXRlIENvMR8wHQYDVQQLDBZNeSBPcmdhbml6 YXRpb25hbCBVbml0MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTEdMBsGCSqGSIb3DQEJ ARYObWVAZXhhbXBsZS5uZXQwHhcNMTcwMTE2MDkxNDMyWhcNMjcwMTE0MDkxNDMy WjCBsTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM DVNhbiBGcmFuY2lzY28xIDAeBgNVBAoMF0NvcHlsZWZ0IENlcnRpZmljYXRlIENv MR8wHQYDVQQLDBZNeSBPcmdhbml6YXRpb25hbCBVbml0MRMwEQYDVQQDDApteUVD c2VydmVyMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDCBmzAQBgcqhkjO PQIBBgUrgQQAIwOBhgAEAWwv2UTxAuqsKkOXqwLCw76trsk+1yFI8TX+9FRfuH2P T1jWk3Pe8a+TYTW+dnHOjXoXRbrnHFKdEfqWBQKR1nrYADaA/OpnESuFzxTYVfMa wkNVGMTWsDEdjBSSBSGCEql4UzS8y5v9Vy6u6GenMCoH+WHcbleZMOj3AFrx1PFO uBb6o4IBOjCCATYwCQYDVR0TBAIwADAdBgNVHQ4EFgQUqBpL9NRgSpBzJqO+ZEQy tldFvMswgecGA1UdIwSB3zCB3IAUSj3MdUw4aAGRLIdvrg2BJ4IRFtKhgbikgbUw gbIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T YW4gRnJhbmNpc2NvMSAwHgYDVQQKDBdDb3B5bGVmdCBDZXJ0aWZpY2F0ZSBDbzEf MB0GA1UECwwWTXkgT3JnYW5pemF0aW9uYWwgVW5pdDEUMBIGA1UEAwwLRWFzeS1S U0EgQ0ExHTAbBgkqhkiG9w0BCQEWDm1lQGV4YW1wbGUubmV0ggkA8TFFCX3Ax5Ew EwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMAoGCCqGSM49BAMCA4GM ADCBiAJCAezxL0fJ03jQENU6xmv9UccdZHRBXUpKfv3zpYMZLtW4szFhrGgIzLVH eUnicoAx6l9cwcfMDHnfqsuTpR2GWiTfAkIBgHCsyvZ1tAYWABgvyOLi10gQZILf qNhDc3y4S5rt1aKW9spsQOmNJSBubjjiJjXolX7qMzegw6WujI5iyTfNNAA= -----END CERTIFICATE----- -----BEGIN EC PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,6778BFA39150BF9E UkkHCq3x6FsWPbW14hFtag+Qc2+iA6bK9teY0uCENWmJFb4UTnJQeW8silkLvUE5 bJ8C7Jxb2vVgufF4zx8BQkVYZipKyUZyjA42Ktjm0GQ6QVJ3mbMYmow4GzWmPbxI fK2Q6C4ZizzYixBqYzq2/fsenkc8Pe9ZRZ5j4ynm5n5H3cLP3hM6fJ+NfzH8v41e FHMXeO38SFvuaHs99E//kU0ClZjIG2oRADBF69BlTtrMpYdgQS7FTOeiqQ3QgVzN rzme9Q7HC7OYmO6b8r0OFq+vSTwNxG6xYAthplrO4h0= -----END EC PRIVATE KEY----- [/oconf] now let's create server config. The same principle as before - I comment out all what is not essential. Less things to troubleshoot. In my working setup I have both files uncommented but before you play with it I really recommend to make sure that you setup works with minimum set of options. [oconf=server]# "dev tun" will create a routed IP tunnel, TCP or UDP server, which port dev tun proto udp port 1194 # SSL/TLS root certificate (ca), certificate (cert), private key (key) and Diffie Hellman parameters (dh) tls-server ca /etc/openvpn/ECCkeys/ca.crt cert /etc/openvpn/ECCkeys/myECserver.crt key /etc/openvpn/ECCkeys/myECserver.crt.key # as we want to go pure EC we don't need DH anymore dh none # Data channel - it will be negotiated with client. Later you can ucomment to enforce your own policies #ncp-ciphers AES-256-GCM #cipher AES-256-GCM #auth SHA512 # Control channel (TLS) - also negotiated with client. #tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 #tls-version-min 1.2 # new in 2.4. does similar job like tls-auth in 2.3 but apparently better #tls-crypt /etc/openvpn/ECCkeys/tc.key 0 #key-direction 0 # Ensure that remote machine has client cert #remote-cert-eku "TLS Web Client Authentication" # replace this section with whatever config you are using server 10.88.90.0 255.255.255.0 ifconfig 10.88.90.1 10.88.90.2 push "route 10.88.90.1 255.255.255.255" push "route 10.88.90.0 255.255.255.0" push "dhcp-option DNS 84.200.69.80" push "dhcp-option DNS 84.200.70.40" push "redirect-gateway def1 bypass-dhcp" #Block IPv6 #push "block-ipv6" # Uncomment this directive to allow different clients to be able to "see" each other. #client-to-client # Uncomment this directive if multiple clients might connect with the same certificate/key #duplicate-cn # The keepalive. Ping every 10 seconds, assume that remote peer is down if no ping received during a 120 second #keepalive 10 120 # Enable compression on the VPN link. Enable the same for client #compress lz4 # don't run server as root user nobody group nogroup # The persist options will try to avoid accessing certain resources on restart # that may no longer be accessible because of the privilege downgrade. #persist-key #persist-tun #persist-local-ip #persist-remote-ip # Output a short status file showing current connections, truncated # and rewritten every minute. status /var/log/openvpn-status_ecc.log 20 # Lof file log /var/log/openvpn_ecc.log #verb 4 #mute-replay-warnings # check revoked certs #crl-verify /etc/openvpn/ECCkeys/crl.pem[/oconf] Everything put together and here we are. Working EC encrypted OpenVPN session: #server starts: Mon Jan 16 11:14:44 2017 OpenVPN 2.4.0 armv7l-unknown-linux-gnueabihf [SSL (mbed TLS)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jan 16 2017 Mon Jan 16 11:14:44 2017 library versions: mbed TLS 2.4.0, LZO 2.09 Mon Jan 16 11:14:44 2017 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Mon Jan 16 11:14:44 2017 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Mon Jan 16 11:14:44 2017 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Mon Jan 16 11:14:44 2017 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Mon Jan 16 11:14:44 2017 ROUTE_GATEWAY 192.168.142.1/255.255.255.0 IFACE=wlan0 HWADDR=f4:f2:6d:0f:68:9b Mon Jan 16 11:14:44 2017 TUN/TAP device tun2 opened Mon Jan 16 11:14:44 2017 TUN/TAP TX queue length set to 100 Mon Jan 16 11:14:44 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Mon Jan 16 11:14:44 2017 /sbin/ifconfig tun2 10.88.90.1 pointopoint 10.88.90.2 mtu 1500 Mon Jan 16 11:14:44 2017 /sbin/route add -net 10.88.90.0 netmask 255.255.255.0 gw 10.88.90.2 Mon Jan 16 11:14:44 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET Mon Jan 16 11:14:44 2017 Socket Buffers: R=[163840->163840] S=[163840->163840] Mon Jan 16 11:14:44 2017 UDPv4 link local (bound): [AF_INET][undef]:1194 Mon Jan 16 11:14:44 2017 UDPv4 link remote: [AF_UNSPEC] Mon Jan 16 11:14:44 2017 GID set to nogroup Mon Jan 16 11:14:44 2017 UID set to openvpn_server Mon Jan 16 11:14:44 2017 MULTI: multi_init called, r=256 v=256 Mon Jan 16 11:14:44 2017 IFCONFIG POOL: base=10.88.90.4 size=62, ipv6=0 Mon Jan 16 11:14:44 2017 Initialization Sequence Completed #client connects: Mon Jan 16 11:15:28 2017 81.109.233.126:51479 TLS: Initial packet from [AF_INET]81.109.233.126:51479, sid=369005aa f97df4d9 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 VERIFY OK: depth=1, C=US, ST=California, L=San Francisco, O=Copyleft Certificate Co, OU=My Organizational Unit, CN=EasyRSA-DB, emailAddress=me@example.net Mon Jan 16 11:15:29 2017 81.109.233.126:51479 Validating certificate extended key usage Mon Jan 16 11:15:29 2017 81.109.233.126:51479 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication Mon Jan 16 11:15:29 2017 81.109.233.126:51479 VERIFY EKU OK Mon Jan 16 11:15:29 2017 81.109.233.126:51479 VERIFY OK: depth=0, C=US, ST=California, L=San Francisco, O=Copyleft Certificate Co, OU=My Organizational Unit, CN=clientname1, emailAddress=me@example.net Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_VER=2.4.0 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_PLAT=mac Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_PROTO=2 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_NCP=2 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_LZ4=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_LZ4v2=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_LZO=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_COMP_STUB=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_COMP_STUBv2=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 peer info: IV_TCPNL=1 Mon Jan 16 11:15:29 2017 81.109.233.126:51479 Control Channel: TLSv1.2, cipher[b][color=#FF0000] TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, 521 bit key[/color][/b] Mon Jan 16 11:15:29 2017 81.109.233.126:51479 [clientname1] Peer Connection Initiated with [AF_INET]81.109.233.126:51479 Mon Jan 16 11:15:29 2017 clientname1/81.109.233.126:51479 MULTI_sva: pool returned IPv4=10.88.90.6, IPv6=(Not enabled) Mon Jan 16 11:15:29 2017 clientname1/81.109.233.126:51479 MULTI: Learn: 10.88.90.6 -> clientname1/81.109.233.126:51479 Mon Jan 16 11:15:29 2017 clientname1/81.109.233.126:51479 MULTI: primary virtual IP for clientname1/81.109.233.126:51479: 10.88.90.6 Mon Jan 16 11:15:30 2017 clientname1/81.109.233.126:51479 PUSH: Received control message: 'PUSH_REQUEST' Mon Jan 16 11:15:30 2017 clientname1/81.109.233.126:51479 SENT CONTROL [clientname1]: 'PUSH_REPLY,route 10.88.90.1 255.255.255.255,route 10.88.90.0 255.255.255.0,dhcp-option DNS 84.200.69.80,dhcp-option DNS 84.200.70.40,redirect-gateway def1 bypass-dhcp,block-ipv6,route 10.88.90.1,topology net30,ping 300,ping-restart 1200,ifconfig 10.88.90.6 10.88.90.5,peer-id 0,cipher AES-256-GCM' (status=1) Mon Jan 16 11:15:30 2017 clientname1/81.109.233.126:51479 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key Mon Jan 16 11:15:30 2017 clientname1/81.109.233.126:51479 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key

As all details of my client config has been stripped out I include unedited version here for your reference: client dev tun remote myserver.com 1194 udp #float #resolv-retry infinite #nobind #persist-key #persist-tun #mute-replay-warnings #key-direction 1 #reneg-sec 0 #compress lz4 #verb 3 #mute 20 #remote-cert-tls server #remote-cert-eku "TLS Web Server Authentication" #verify-x509-name DB-OpenVPN-Server name #cipher AES-256-GCM #auth SHA512 -----BEGIN CERTIFICATE----- MIIEDzCCA3CgAwIBAgIJAPExRQl9wMeRMAoGCCqGSM49BAMCMIGyMQswCQYDVQQG EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj bzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlmaWNhdGUgQ28xHzAdBgNVBAsMFk15 IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNVBAMMC0Vhc3ktUlNBIENBMR0wGwYJ KoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDAeFw0xNzAxMTYwOTE0MDJaFw0yNzAx MTQwOTE0MDJaMIGyMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEW MBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlm aWNhdGUgQ28xHzAdBgNVBAsMFk15IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNV BAMMC0Vhc3ktUlNBIENBMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDCB mzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAWGwh3oYzUzpVX7qyqO4A0ygo834d4eZ 2ZPHOYoxZRdBieQv51pCY6hZl/6/qlcUl8pKqn7mDWH9ySIIiqz0X8QTAM6XSH8H at/thQPZt5o6sRrJqrBCuX0h8lZs0QWIRs4od0442NQIJ7spu5MIYXCoycuoZm+b RGocerRG6Mmt0G3Mo4IBKDCCASQwHQYDVR0OBBYEFEo9zHVMOGgBkSyHb64NgSeC ERbSMIHnBgNVHSMEgd8wgdyAFEo9zHVMOGgBkSyHb64NgSeCERbSoYG4pIG1MIGy MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2Fu IEZyYW5jaXNjbzEgMB4GA1UECgwXQ29weWxlZnQgQ2VydGlmaWNhdGUgQ28xHzAd BgNVBAsMFk15IE9yZ2FuaXphdGlvbmFsIFVuaXQxFDASBgNVBAMMC0Vhc3ktUlNB IENBMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldIIJAPExRQl9wMeRMAwG A1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMAoGCCqGSM49BAMCA4GMADCBiAJCAKWu xGrpBfNnKpTOSCG0P9veO1SO86HUuRubTYtf66RNjH+K4PV1DT2z65FwN42VvAK/ M3by41KiHGDxZvupOtNCAkIBbXJkDU6NHNcX7fMwD0TpjThi8Iim0PKATuT32CcK nM5BwY5HsNhnomYNWo74hZ9oUUJi+upkaqSzYtNJJboPzZ0= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEGDCCA3mgAwIBAgIBATAKBggqhkjOPQQDAjCBsjELMAkGA1UEBhMCVVMxEzAR BgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xIDAeBgNV BAoMF0NvcHlsZWZ0IENlcnRpZmljYXRlIENvMR8wHQYDVQQLDBZNeSBPcmdhbml6 YXRpb25hbCBVbml0MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTEdMBsGCSqGSIb3DQEJ ARYObWVAZXhhbXBsZS5uZXQwHhcNMTcwMTE2MDkxNDMyWhcNMjcwMTE0MDkxNDMy WjCBsTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM DVNhbiBGcmFuY2lzY28xIDAeBgNVBAoMF0NvcHlsZWZ0IENlcnRpZmljYXRlIENv MR8wHQYDVQQLDBZNeSBPcmdhbml6YXRpb25hbCBVbml0MRMwEQYDVQQDDApteUVD c2VydmVyMR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLm5ldDCBmzAQBgcqhkjO PQIBBgUrgQQAIwOBhgAEAWwv2UTxAuqsKkOXqwLCw76trsk+1yFI8TX+9FRfuH2P T1jWk3Pe8a+TYTW+dnHOjXoXRbrnHFKdEfqWBQKR1nrYADaA/OpnESuFzxTYVfMa wkNVGMTWsDEdjBSSBSGCEql4UzS8y5v9Vy6u6GenMCoH+WHcbleZMOj3AFrx1PFO uBb6o4IBOjCCATYwCQYDVR0TBAIwADAdBgNVHQ4EFgQUqBpL9NRgSpBzJqO+ZEQy tldFvMswgecGA1UdIwSB3zCB3IAUSj3MdUw4aAGRLIdvrg2BJ4IRFtKhgbikgbUw gbIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T YW4gRnJhbmNpc2NvMSAwHgYDVQQKDBdDb3B5bGVmdCBDZXJ0aWZpY2F0ZSBDbzEf MB0GA1UECwwWTXkgT3JnYW5pemF0aW9uYWwgVW5pdDEUMBIGA1UEAwwLRWFzeS1S U0EgQ0ExHTAbBgkqhkiG9w0BCQEWDm1lQGV4YW1wbGUubmV0ggkA8TFFCX3Ax5Ew EwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMAoGCCqGSM49BAMCA4GM ADCBiAJCAezxL0fJ03jQENU6xmv9UccdZHRBXUpKfv3zpYMZLtW4szFhrGgIzLVH eUnicoAx6l9cwcfMDHnfqsuTpR2GWiTfAkIBgHCsyvZ1tAYWABgvyOLi10gQZILf qNhDc3y4S5rt1aKW9spsQOmNJSBubjjiJjXolX7qMzegw6WujI5iyTfNNAA= -----END CERTIFICATE----- -----BEGIN EC PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,6778BFA39150BF9E UkkHCq3x6FsWPbW14hFtag+Qc2+iA6bK9teY0uCENWmJFb4UTnJQeW8silkLvUE5 bJ8C7Jxb2vVgufF4zx8BQkVYZipKyUZyjA42Ktjm0GQ6QVJ3mbMYmow4GzWmPbxI fK2Q6C4ZizzYixBqYzq2/fsenkc8Pe9ZRZ5j4ynm5n5H3cLP3hM6fJ+NfzH8v41e FHMXeO38SFvuaHs99E//kU0ClZjIG2oRADBF69BlTtrMpYdgQS7FTOeiqQ3QgVzN rzme9Q7HC7OYmO6b8r0OFq+vSTwNxG6xYAthplrO4h0= -----END EC PRIVATE KEY-----

So the latest and greatest what OpenVPN has to offer works perfectly: TLS channel uses elliptic curve diffie-hellmann key exchange (ECDH) with elliptic curve digital signature algorithm (ECDSA)- TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, 521 bit key and data channel the latest AEAD (GCM) cipher AES-256-GCM

[quote="dariusz"]As all details of my client config has been stripped out[/quote]The details are all still in your post .. press the [b]View Original[/b] button to see them.

not all. I wanted to make sure that difference with RSA keys is shown here. not sure if it matters, but if yes than better to have it all for EC keys: -----BEGIN EC PRIVATE KEY----- for RSA keys: -----BEGIN RSA PRIVATE KEY-----

Thanks for the guide, I will try this in the weekend Just some questions Can this be used instead for server / client [code]build-client-full client_1 nopass build-server-full server nopass[/code] And ta.key with tls-auth or tls-crypt with EC ? Will this settings be useful for the server config file ? [code]ecdh-curve sect571r1[/code] BR Peter

build-client-full or build-server-full should do the trick as well but I have not tried myself in terms of of ecdh-curve as per man pages this: " --ecdh-curve name Specify the curve to use for elliptic curve Diffie Hellman. Available curves can be listed with --show-curves. The specified curve will only be used for ECDH TLS-ciphers. This option is not supported in mbed TLS builds of OpenVPN." You can build openvpn 2.4 with openssl as well than it will work.

Hi, Some more Q I would like to see how dh key could be used with EC :-) is it ecdh ? I have not found how do that? So try to find a a way to use ta.key and dh.key with EC then this guide is completed :-) :-) I'm on a Slackware system (unRAID) //Peter

you can use either ta.key (--tls-auth) like in 2.3 or new tc.key (--tls-crypt) - unfortunately they are mutually exclusive. it can be actually the same key but you have to decide its use. you generate it like always openvpn --genkey --secret tls.key. If you look at raw version of my configs you will see that I use --tls-crypt (then you have also add it to client config) DH - if you wish you can generate DH key and use for tls like TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384. It is entirely up to you. Such key exchange would be slower and less secure. You can only use up to 4096 RSA when 521 elliptic key is equivalent of 15000 something RSA. Check with openvpn --show-tls - the keys are sorted according to their strength. My objective here was to go full elliptic:) strongest possible crypto OpenVPN can offer. There are many other options how to configure it. But again - I just wanted to see pure elliptic in action.

actually i might be a bit wrong about my DH usage explanation. you have to do your own research.

check this out https://community.openvpn.net/openvpn/ticket/410

OpenVPN 2.4 and pure elliptic curve crypto setup

umdmc

Yep. I checked both and they are different. So I guess it worked?

kptsky

3des file should indicate that key as encrypted like in my example.

3des or aes key encryption is only important when transferring keys to your client over insecure channel. It protects your private key from being compromised when in transit.

umdmc

Oh ok. Not sure why I am not getting the same output. Whatever it did, the new key still worked.

EDIT:

I must have typed something wrong initially because I went back and tried it and it worked. Oops. ;-)

matt3226

Then I have built the latest OpenVPN 2.4
wget https://swupdate.openvpn.org/community/ ... 4.0.tar.gz
tar xvf openvpn-2.4.0.tar.gz
cd openvpn-2.4.0
./configure --with-crypto-library=mbedtls
make
sudo make install

I got errors while doing ./configure --with-crypto-library=mbedtls and fixed it following this thread on stackoverflow

I just drop it here to help out anyone following this tutorial..

matt3226

I'm stuck at the command

./easyrsa init-pki

There seems to be something wrong with my openssl command, can't attach files here so here's an imgur

I'm using mbedtls-2.5.1, openssl-1.1.0f , and openvpn-2.4.3

kptsky

there is no openssl in /usr/local/bin/openssl

you have to edit the following line in the vars file

set_var EASYRSA_OPENSSL "/usr/local/opt/openssl/bin/openssl"

and set this to wherever your openssl is

matt3226

Newbie question, how do I find where my openssl is located?

Is there a command I could run to find out?

kptsky

which openssl

But then check if this the right one in case your have multiple versions installed

WhateverPath/openssl version

matt3226

which openssl outputs /usr/local/bin/openssl

EDIT: running openssl will output

openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

kptsky

And

/usr/local/bin/openssl version

?

matt3226

same thing:

openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

EDIT: Closest solution I've found was in this thread

I followed along and ran

sudo apt-get install libssl1.0.0 libssl-dev

kptsky

Your OpenSSL is corrupted or not installed properly

matt3226

Download and do the config, make, make install again?

This time i'll verify the checksum or gpg...

Pippin

cd /

find -name openssl

/path..../openvpn --version

matt3226

find -name openssl

./home/pi/openssl-1.1.0f/apps/openssl
./home/pi/openssl-1.1.0f/include/openssl
./usr/local/include/openssl
./usr/local/share/doc/openssl
./usr/local/bin/openssl
./usr/lib/ruby/2.1.0/openssl
./usr/include/arm-linux-gnueabihf/openssl
./usr/include/openssl
./usr/share/doc/openssl
./usr/share/bash-completion/completions/openssl
./usr/bin/openssl

The openVPN that I'm currently running is version 2.4.3

kptsky

I suggest to use fresh openssl

Download 1.1.0f, untar

./config shared -Wl,-rpath=/opt/openssl-1.1.0f/lib --prefix=/opt/openssl-1.1.0f/
make
sudo make install

It will install fresh openssl in /opt folder so make sure that your easyrsa vars file points to /opt/openssl-1.1.0f/bin/openssl

matt3226

Okay, just downloaded and sha256 checks out good. That command looks a little cryptid, what does it do?

 ./config shared -Wl,-rpath=/opt/openssl-1.1.0f/lib --prefix=/opt/openssl-1.1.0f/

kptsky

https://wiki.openssl.org/index.php/Compilation_and_Installation#Using_RPATHs

if you don't compile openvpn with openssl (and i understand you use mbedtls) you can omit rpath but I use it to avoid libraries linking problems in other software I use openssl for.

https://stackoverflow.com/questions/38985889/build-openvpn-with-specific-openssl-version

kptsky

In case you would like to compile openvpn with openssl use following for openvpn:

./configure \
--enable-systemd \
CFLAGS="-I/opt/openssl-1.1.0f/include -Wl,-rpath=/opt/openssl-1.1.0f/lib -L/opt/openssl-1.1.0f/lib" \

matt3226

Ah, I see:

Note well: you should use a RPATH when building both OpenSSL and your program. If you don't add a RPATH to both, then your program could runtime-link to the wrong version of OpenSSL.

Okay, making now, should take some time..

« Previous Page Next Page »