I updated to 1.2.5 today and expected support for OpenVPN 2.4 but I'm still getting [quote] Tue Jan 9 06:05:51 2018 122.23.165.166:53302 TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive. Tue Jan 9 06:05:51 2018 122.23.165.166:53302 OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Tue Jan 9 06:05:51 2018 122.23.165.166:53302 TLS_ERROR: BIO read tls_read_plaintext error Tue Jan 9 06:05:51 2018 122.23.165.166:53302 TLS Error: TLS object -> incoming plaintext read error Tue Jan 9 06:05:51 2018 122.23.165.166:53302 TLS Error: TLS handshake failed Tue Jan 9 06:05:51 2018 122.23.165.166:53302 SIGUSR1[soft,tls-error] received, client-instance restarting [/quote] From the FAQ: [quote] I cannot connect to the server (client times out), and the server log file shows "TLS_ERROR: BIO read tls_read_plaintext error: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher". This is usually remedied by going to the OpenVPN section of the iOS Settings app and selecting "Force AES-CBC ciphersuites". [/quote] Setting for AES-CBC did not work. Can anybody advise which tls cipher will work for me? Here's my server config which works on OS X Tunnelblick. [code] dev tun proto udp port 1194 user ovpn group ovpn ca ca.crt cert server.crt key server.key server 10.3.255.0 255.255.255.0 ifconfig-pool-persist ipp.txt ncp-disable cipher AES-256-GCM auth SHA512 tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 dh none ecdh-curve secp521r1 keepalive 10 120 persist-key persist-tun tls-server tls-crypt /etc/openvpn/server/tls-auth.key [/code] Here is my client config [code] client proto udp dev tun persist-key persist-tun remote vpn.mydomain.com 1194 resolv-retry infinite nobind explicit-exit-notify 1 remote-cert-tls server auth SHA512 cipher AES-256-GCM tls-version-min 1.2 tls-client ping 15 ping-restart 120 [/code] keys redqcted

[quote=markhorrocks post_id=75600 time=1515508818 user_id=41303] [code] tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 [/code] [/quote] *-ECDSA-* is not yet supported by OpenVPN Connect. ECDHE is ok, but ECDSA must be substituted with RSA. An alternative is to remove this statement and let client and server negotiate the best cipher suite.

I did comment out that line but still got the same error. I have verified that the line is indeed commented out on the server. [code] tls-version-min 1.2 # tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 [/code]

I'm having exactly this issue. It seems that 1.2.5 doesn't work with ECDHE-RSA. :( Server log shows: [code] 82.132.227.120:34080 TLS: Initial packet from [AF_INET]82.132.227.120:34080, sid=be63b871 ce68bc21 82.132.227.120:34080 TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive. 82.132.227.120:34080 OpenSSL: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher 82.132.227.120:34080 TLS_ERROR: BIO read tls_read_plaintext error 82.132.227.120:34080 TLS Error: TLS object -> incoming plaintext read error 82.132.227.120:34080 TLS Error: TLS handshake failed 82.132.227.120:34080 SIGUSR1[soft,tls-error] received, client-instance restarting [/code] I'm not specifying a tls-cipher option either (leaving it to be negotiated). [oconf=server] dev tun proto udp port 1194 sndbuf 393216 rcvbuf 393216 push "sndbuf 393216" push "rcvbuf 393216" ca /etc/openvpn/eckeys/ca.crt cert /etc/openvpn/eckeys/server-ec.crt key /etc/openvpn/eckeys/server-ec.key dh none server 10.188.0.0 255.255.255.0 ifconfig 10.188.0.1 10.188.0.2 push "route 10.188.0.1 255.255.255.255" push "route 10.188.0.0 255.255.255.0" push "route 192.168.2.0 255.255.255.0" push "dhcp-option DNS 192.168.2.1" push "redirect-gateway def1" client-to-client keepalive 10 60 tls-crypt /etc/openvpn/eckeys/tc.key cipher AES-128-GCM ncp-ciphers AES-128-GCM tls-version-min 1.2 user nobody group nogroup persist-key persist-tun reneg-sec 0 mute-replay-warnings status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 3 [/oconf] [oconf=client] client dev tun proto udp remote myserverdomain 1194 nobind persist-key persist-tun reneg-sec 0 mute-replay-warnings remote-cert-tls server cipher AES-128-GCM tls-version-min 1.2 verb 3 mute 20 -----BEGIN CERTIFICATE----- blah blah -----END CERTIFICATE----- # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- blah blah -----END OpenVPN Static key V1----- [/oconf]

[quote=GainfulShrimp post_id=75990 time=1515871927 user_id=32173] I'm having exactly this issue. It seems that 1.2.5 doesn't work with ECDHE-RSA. :( Server log shows: [code] 82.132.227.120:34080 TLS: Initial packet from [AF_INET]82.132.227.120:34080, sid=be63b871 ce68bc21 82.132.227.120:34080 TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive. 82.132.227.120:34080 OpenSSL: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher 82.132.227.120:34080 TLS_ERROR: BIO read tls_read_plaintext error 82.132.227.120:34080 TLS Error: TLS object -> incoming plaintext read error 82.132.227.120:34080 TLS Error: TLS handshake failed 82.132.227.120:34080 SIGUSR1[soft,tls-error] received, client-instance restarting [/code] I'm not specifying a tls-cipher option either (leaving it to be negotiated). [/quote] Are your certs ECC or RSA?

[quote=ordex post_id=75997 time=1515895758 user_id=39103] Are your certs ECC or RSA? [/quote] Thanks @ordex, I think you've nailed the problem... I was getting confused between ECC for [i]key exchange (e.g. ECDHE)[/i] and ECC for [i]signatures (e.g. ECDSA)[/i]. For version 1.2.5 of OpenVPN Connect (iOS), we can only use ECC for key exchange but [b]not[/b] ECC keys/signatures. Thus, trying to use ECC signatures/keys will fail for version 1.2.5, irrespective of whether the key exchange is ECC...

[quote=ordex post_id=75609 time=1515512856 user_id=39103] [quote=markhorrocks post_id=75600 time=1515508818 user_id=41303] [code] tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 [/code] [/quote] *-ECDSA-* is not yet supported by OpenVPN Connect. ECDHE is ok, but ECDSA must be substituted with RSA. An alternative is to remove this statement and let client and server negotiate the best cipher suite. [/quote] Hi @ordex If I want to support ECDSA for iOS, do I need to modify the open VPN source? Or modify the configuration environment? Can you tell me the direction of ECDSA? thank you..

[quote=rcy1122 post_id=76045 time=1516073618 user_id=43016] [quote=ordex post_id=75609 time=1515512856 user_id=39103] [quote=markhorrocks post_id=75600 time=1515508818 user_id=41303] [code] tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 [/code] [/quote] *-ECDSA-* is not yet supported by OpenVPN Connect. ECDHE is ok, but ECDSA must be substituted with RSA. An alternative is to remove this statement and let client and server negotiate the best cipher suite. [/quote] Hi @ordex If I want to support ECDSA for iOS, do I need to modify the open VPN source? Or modify the configuration environment? Can you tell me the direction of ECDSA? thank you.. [/quote] Hi there and thanks for offering help! At the moment we lack support for ECDSA in the core. Therefore the first step to take would be to implement ECDSA support in the openvpn3-core (https://github.com/OpenVPN/openvpn3) and ensure that all the inner components have what they need. Once the openvpn3-core alone supports ECDSA, then *I think* that the iOS UI code won't need any change - but of course the app needs to be rebuilt using the new core.

Thank you for your reply, feel like doing a lot of things. But, Why is ecdsa supported on Linux?

[quote=ordex post_id=76046 time=1516074184 user_id=39103] [quote=rcy1122 post_id=76045 time=1516073618 user_id=43016] [quote=ordex post_id=75609 time=1515512856 user_id=39103] *-ECDSA-* is not yet supported by OpenVPN Connect. ECDHE is ok, but ECDSA must be substituted with RSA. An alternative is to remove this statement and let client and server negotiate the best cipher suite. [/quote] Hi @ordex If I want to support ECDSA for iOS, do I need to modify the open VPN source? Or modify the configuration environment? Can you tell me the direction of ECDSA? thank you.. [/quote] Hi there and thanks for offering help! At the moment we lack support for ECDSA in the core. Therefore the first step to take would be to implement ECDSA support in the openvpn3-core (https://github.com/OpenVPN/openvpn3) and ensure that all the inner components have what they need. Once the openvpn3-core alone supports ECDSA, then *I think* that the iOS UI code won't need any change - but of course the app needs to be rebuilt using the new core. [/quote] Thank you for your reply, feel like doing a lot of things. But, Why is ecdsa supported on Linux?

[quote=rcy1122 post_id=76048 time=1516083460 user_id=43016] Thank you for your reply, feel like doing a lot of things. But, Why is ecdsa supported on Linux? [/quote] Are you talking about OpenVPN 2.x? If yes, that's a totally different code base (and yes, ECDSA is supported there). OpenVPN Connect is based on OpenVPN3 (link to the repo in my previous post) which is a rewrite from scratch of the core component. If you are interested, a Linux client using OpenVPN3 is currently under development (https://github.com/OpenVPN/openvpn3-linux), but can already be tested.

Loading...

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

OpenVPN 1.2.5 (iOS): ECDHE-ECDSA support

« Previous Page