I'm hoping someone can clarify the relationship between some config options and output I'm getting in my logs. Even though I have [b]tls-ciphersuites TLS_AES_256_GCM_SHA384[/b] specified (supported by my instance according to [b]--show-tls[/b]), I see the following in my logs: [code]Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Outgoing Control Channel Encryption: CIPHER block_size=16 iv_size=16 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Incoming Control Channel Encryption: CIPHER block_size=16 iv_size=16 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication[/code] I'm guessing the [b]tls-ciphersuites[/b] option only applies to the data channel, but the man page makes it sound like it should apply to the control channel as well: [quote] --tls-ciphersuites l A list l of allowable TLS ciphers delimited by a colon (“:”).This setting can be used to ensure that certain cipher suites are used (or not used) for the TLS connection. OpenVPN uses TLS to secure the control channel, over which the keys that are used to protect the actual VPN traffic are exchanged.[/quote] Is there any way to specify cipher for the control channel? [code]# openvpn --version OpenVPN 2.4.8 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb 7 2020 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 Originally developed by James Yonan Copyright (C) 2002-2018 OpenVPN Inc Compile time defines: enable_async_push='no' enable_comp_stub='no' enable_crypto='yes' enable_crypto_ofb_cfb='yes' enable_debug='yes' enable_def_auth='yes' enable_dlopen='unknown' enable_dlopen_self='unknown' enable_dlopen_self_static='unknown' enable_fast_install='yes' enable_fragment='yes' enable_iproute2='yes' enable_libtool_lock='yes' enable_lz4='yes' enable_lzo='yes' enable_management='yes' enable_multihome='yes' enable_pam_dlopen='no' enable_pedantic='no' enable_pf='yes' enable_pkcs11='no' enable_plugin_auth_pam='yes' enable_plugin_down_root='yes' enable_plugins='yes' enable_port_share='yes' enable_selinux='no' enable_server='yes' enable_shared='yes' enable_shared_with_static_runtimes='no' enable_small='no' enable_static='yes' enable_strict='no' enable_strict_options='no' enable_systemd='no' enable_werror='no' enable_win32_dll='yes' enable_x509_alt_username='no' with_aix_soname='aix' with_crypto_library='openssl' with_gnu_ld='yes' with_mem_check='no' with_sysroot='no'[/code]

[quote=aduty post_id=90976 time=1586464412 user_id=49943] I'm guessing the tls-ciphersuites option only applies to the [b]data[/b] channel, [/quote]TLS ciphers are for the [u]control[/u] channel, as I understand it. Full configs and logs .. etc. Maybe ask in the IRC channel.

tls-ciphersuites option not honored

aduty

I'm hoping someone can clarify the relationship between some config options and output I'm getting in my logs.

Even though I have tls-ciphersuites TLS_AES_256_GCM_SHA384 specified (supported by my instance according to --show-tls), I see the following in my logs:

Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: CIPHER block_size=16 iv_size=16
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: CIPHER block_size=16 iv_size=16
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication

I'm guessing the tls-ciphersuites option only applies to the data channel, but the man page makes it sound like it should apply to the control channel as well:

--tls-ciphersuites l
A list l of allowable TLS ciphers delimited by a colon (“:”).This setting can be used to ensure that certain cipher suites are used (or not used) for the TLS connection. OpenVPN uses TLS to secure the control channel, over which the keys that are used to protect the actual VPN traffic are exchanged.

Is there any way to specify cipher for the control channel?

# openvpn --version
OpenVPN 2.4.8 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  7 2020
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push='no' enable_comp_stub='no' enable_crypto='yes' enable_crypto_ofb_cfb='yes' enable_debug='yes' enable_def_auth='yes' enable_dlopen='unknown' enable_dlopen_self='unknown' enable_dlopen_self_static='unknown' enable_fast_install='yes' enable_fragment='yes' enable_iproute2='yes' enable_libtool_lock='yes' enable_lz4='yes' enable_lzo='yes' enable_management='yes' enable_multihome='yes' enable_pam_dlopen='no' enable_pedantic='no' enable_pf='yes' enable_pkcs11='no' enable_plugin_auth_pam='yes' enable_plugin_down_root='yes' enable_plugins='yes' enable_port_share='yes' enable_selinux='no' enable_server='yes' enable_shared='yes' enable_shared_with_static_runtimes='no' enable_small='no' enable_static='yes' enable_strict='no' enable_strict_options='no' enable_systemd='no' enable_werror='no' enable_win32_dll='yes' enable_x509_alt_username='no' with_aix_soname='aix' with_crypto_library='openssl' with_gnu_ld='yes' with_mem_check='no' with_sysroot='no'

TinCanTech

aduty wrote I'm guessing the tls-ciphersuites option only applies to the data channel,

TLS ciphers are for the control channel, as I understand it.

Full configs and logs .. etc.

Maybe ask in the IRC channel.