On
https://openvpn.net/community-resources/openvpn-protocol/ the website states "In SSL/TLS mode" - for me this means that there is at least one other mode, which is it/are they and how do I select between them?
EDIT: Just after writing this I found out there are two modes, TLS and common secret mode (non-TLS static key encryption mode). this are all modes, as manpage states "both modes". and tls is used if no "secret file" is defined which enables the non-TLS mode. The other questions still apply:
My understanding of TLS mode is: OpenVPN server waits for incoming TCP-TLS-connections on the defined port, checks certificates on both sides, agrees on a session key,crypto-algorithm and port-pair (client-port and server-port) for the actual tunnel which is either transfered udp or tcp defined by the proto parameter.
tls-auth is a little misleading as TLS does authentication as well, but tls-auth is an optional HMAC used to be able to drop illegitimate packets faster and prevent for example DoS. tls-auth applies only to the signaling channel, not to the tunnel.
The tunnel is encrypted by a stream cipher without TLS overhead.
Is that correct?
- If I do not define tls-cipher on the client side (config file), OpenSSL version uses EFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA
as stated on the man page. Does this include ciphers that one would want to avoid?
Can I test a server for heartbleed besides checking the installed version on the system? (I would like to ensure my VPN provider uses an up-to-date server)
A related topic is here from 2014 about knowing the version of the other sites OpenVPN software:
https://forums.openvpn.net/viewtopic.php?f=4&t=15548&p=42485&hilit=heartbleed#p42485
