OpenVPN handshake failed after disable TLS1.0 in OpenSSL

sara_liu

Hi All
Recently I met an issue,When I disable the TLS1.0 in OpenSSL,I found When OpenVPN start,It can't get the vpn IP.I got the OpenVPN log as below highligh words show,

My OpenVPN version is 2.4.7 and the OpenSSl version is 1.1.0d,We disabled the TLS 1.0 in OpenSSL thru add "no-tls1" when compile OpenSSL library.After this update, the OpenVPN can't get the IP with below error.
Thru the error lg it seems vpn client and server not communicate a common TLS version.I add the "tls-version-min 1.1" in vpn client configuration,and restart the OpenVPN again,It seems still has this issue.I don't have method to add "tls-version-min 1.1" to vpn server's configuration because the server is run in customer side,Do anybody see this issue ? Could you kindly give me some comment?Thanks.

Tue Feb 18 08:15:09 2020 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Feb 18 08:15:09 2020 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Feb 18 08:15:09 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]192.155.71.27:1294
Tue Feb 18 08:15:09 2020 Socket Buffers: R=[163840->163840] S=[655360->655360]
Tue Feb 18 08:15:09 2020 UDP link local: (not bound)
Tue Feb 18 08:15:09 2020 UDP link remote: [AF_INET]192.155.71.27:1294
Tue Feb 18 08:15:09 2020 TLS: Initial packet from [AF_INET]192.155.71.27:1294, sid=08c9b523 807d531b
Tue Feb 18 08:15:09 2020 TLS error: Unsupported protocol. This typically indicates that client and server have no common TLS version enabled. This can be caused by mismatched tls-version-min and tls-version-max options on client and server. If your OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only

TinCanTech

sara_liu wrote My OpenVPN version is 2.4.7 and the OpenSSl version is 1.1.0d,We disabled the TLS 1.0 in OpenSSL thru add "no-tls1" when compile OpenSSL library.After this update, the OpenVPN can't get the IP with below error.

sara_liu wrote Tue Feb 18 08:15:09 2020 TLS error: Unsupported protocol. This typically indicates that client and server have no common TLS version enabled. This can be caused by mismatched tls-version-min and tls-version-max options on client and server. If your OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only

You have compiled your own version of openssl and probably the same with openvpn so you are on your own.

sara_liu wrote Could you kindly give me some comment?Thanks

Use an officially supported version of openvpn and openssl.

sara_liu

Yes,I know use the official supported version of OPenVPn and OpenSSL,it will work as normal.
But as the security issue of the TLS1.0,we must disable it.And this will cause vpn wok abnormal.
What confused me is if vpn client has limit to the tls version ,even though there is no tls1.0 library(has disabled when compile openssl,so there will no 1.0 library),the vpn client and server should negotiate common TLS1.0,right?

TinCanTech

I too wish to live on a desert island with nought but myself for company.

Mess with the source at your own peril.