TLS 1.3 support and openssl library

blackexpresso

Hi.

I use last openvpn version 2.4.7.

I need to use tls 1.3.

2.4.7 is supporting tls 1.3 but it's needed to update library.

I've done this and all is ok.

But.

I use and find only 1.1.1a x64 (alpha) library.

Does openvpn recommend a special openssl for x64? Is it a no alpha version?

Thanks.

IPTRACE

Hello!

I had the same issue.

1. I was using OpenVPN server 2.4.6 with OpenSSL 1.1.1a and OpenVPN Windows Client 2.4.6 with updated two libraries. It was working with TLSv1.3 .
2. After upgrade client to 2.4.7 at first, I couldn't establish TLSv1.3 conection. So, I upgraded server to 2.4.7 but without any progress.
3. Then I decied to copy the same libraries (libcrypto-1_1-x64.dll, libssl-1_1-x64.dll) from OpenSSL-Win64 package and It's started to work.

It's desirable to repair OpenVPN Windows Client 2.4.7 version with working libraries for TLSv1.3 .

plaisthos

Yes, it is desirable but currentl OpenSSL 1.1.1/TLS 1.3 breaks cryptoapicert in OpenVPN 2.x. There are patches that are already applied to current development version but for the stable we decided not to break cryptoapicert in Windows.

blackexpresso

Hi and thanks to answer.

@plaisthos : I use now 2.4.7 on w10 x64 pro, and 1.1.1b.

Can you explain more about the break..? and windows.

I just a user.

I use vpn with RSA4096 tls1.2 and ec (ed448) with tls1.3.
I can stop to use tls1.3 if it's a break.

i don't like garden work as doh too. if tls1.3 is full of break.........

plaisthos

If you are not using cryptoapicert using TLS 1.3 is fine for Windows. But we do not want to ship a distribution that breaks existing configuration.

blackexpresso

for simple users as me, can you explain if we use cryptoapicert using commercial vpn?

Finally, i stop to use tls1.3 and 1.1.1.
I wait the good and stable version.
Thanks