Is OpenVpn 2.4.8 compatible with TLS 1.3?

Daimroc

I am wondering if OpenVpn is compatible with TLS 1.3 or not.

I am using OpenVpn 2.4.8 (the last version) and I am trying to set the version of TLS in my server config file with:

--tls-version-min 1.3
--tls-version-max 1.3

But i get an error that says it is not a correct parameter: "Options error: unknown tls-version-min parameter: 1.3. Use --help for more information."

If use the command --show-tls l I get a list of the cyphers that I can use with TLS, and it says for TLS 1.2 and older.

However, in the documentation of the versión 2.4.7 I can read that:

- Add support for tls-ciphersuites for TLS 1.3
- Add better support for showing TLS 1.3 ciphersuites in --show-tls
- Use right function to set TLS1.3 restrictions in show-tls

And in the versión 2.4.5 of OpenVpn I can read:

- Add support for TLS 1.3 in --tls-version-{min, max}

But when I use this parameter, I get an error.

So, how could I set the version of TLS that the server accepts?

Thanks.

TinCanTech

Try 'or-highest':

--tls-version-min 1.3 'or-highest'
--tls-version-max 1.3 'or-highest'

See TLS mode options in the manual.

Daimroc

If I use this parameters I get another error:

Options error: Unrecognized option or missing or extra parameter(s) in server.ovpn:87: tls-version-max (2.4.8)
Use --help for more information.

I have read the documentation, but I don't find the way to configure this.

PD: I have tried to set 1.2 and it works, but 1.3 doesn't work.

TinCanTech

Daimroc wrote PD: I have tried to set 1.2 and it works, but 1.3 doesn't work

Daimroc wrote I have read the documentation,

Then you will understand that this is a function of your SSL library version not openvpn.

KolanKoala

I solved this by using a workaround:
https://slproweb.com/products/Win32OpenSSL.html
Get the OpenSSL 1.1.1 binaries for windows (the lastest light version will do, at the time of writing it was https://slproweb.com/download/Win64OpenSSL_Light-1_1_1f.exe), download and extract. (donate to the dev).

Replace

C:\Program Files\OpenVPN\bin\libcrypto-1_1-x64.dll
C:\Program Files\OpenVPN\bin\libssl-1_1-x64.dll

with the OpenSSL 1.1.1 versions on both the client and server sides.

TLS 1.3 now working, happy days 🐨 😉
Still cannot use "tls-version-min 1.3" directive on the server config file though, needs to be "tls-version-min 1.2" as the "tls-version-min 1.3" directive is unrecognised by the OpenVPN binary, yet it still uses 1.3 with the newer crypto dlls above.
Hope this helps someone save a few hours trying to work it out