I was wondering if I can use Keys/Certs generated with the SHA256withECDSA using OpenVPN 2.3.10.

I tried it and I get a: [code]TLS_ERROR: BIO read tls_read_plaintext error: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher [/code] I’m not setting a tls-cipher on either the server or the client.

Well .. "no shared cipher" means [b]exactly[/b] what it says ..

What doesn’t make sense is the two clients are both 2.3.x? The client is 2.3.17 and the server is 2.3.10. Would this cause the no shared cipher issue or is using keys/certs with the SHA256withECDSA algorithm causing the no shared cipher error?

Your server and client have no ciphers which they can both use. eg. "shared" cipher. Considering the lack of detail you have provided, it is difficult to expand on that.

Here is the server config: [oconf=Server config] port 1194 proto udp dh dh2048.pem server 10.8.0.0 255.255.252.0 ifconfig-pool-persist ipp.txt keepalive 10, 120 ca ca.crt cert server.crt key server.key crl-verify crl.pem dev tun tun-mtu 1500 tls-auth ta.key 0 route 10.11.0.0 255.255.0.0 push route 10.11.0.0 255.255.0.0 client-config-dir ccd cipher AES-128-CBC auth SHA256 comp-lzo verb 3 [/oconf] I'm not sure what additional information I can give you. The client config is on a router that I set using a graphical user interface.

Thistle get you started: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

[code] keepalive 10, 120 [/code] Comma doesn't belong there.

This is the full error from the server log: [code]2020/07/23 05:29:13 DEBUG [openvpn-proc] Stdout: Thu Jul 23 05:29:13 2020 70.168.153.252:49046 TLS: Initial packet from [AF_INET]70.168.153.252:49046, sid=ebcceffc ecf400f9 2020/07/23 05:29:13 DEBUG [openvpn-proc] Stdout: Thu Jul 23 05:29:13 2020 70.168.153.252:49046 TLS_ERROR: BIO read tls_read_plaintext error: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher 2020/07/23 05:29:13 DEBUG [openvpn-proc] Stdout: Thu Jul 23 05:29:13 2020 70.168.153.252:49046 TLS Error: TLS object -> incoming plaintext read error[/code]

[quote=Pippin post_id=93342 time=1595529384 user_id=32724] [code] keepalive 10, 120 [/code] Comma doesn't belong there. [/quote]Looks like somebody should report a bug.

SHA256withECDSA on OpenVPN 2.3.10

TinCanTech

apache8080 wrote I can’t post the client config since as I said earlier it gets set using a graphical user interface. I have no way of knowing the exact client config running on the router

You learn how your router works and extract the necessary information.

apache8080 wrote this is a fairly general question about wether or not the code supports this

This is a security question .. there is no such thing as fairly general.

apache8080 wrote If this forum doesn’t support questions like this then just saying we don’t know would be more helpful than what you are currently doing

We do not know based upon what you are capable of posting .. we have been as helpful as possible, under the circumstances.

The bottom line is .. what you want does not work with what you have ..

Computer security:

Secure / Cheap / Easy

You can only chose two .. :geek:

apache8080

Thanks for the help. Apologies for the annoyance, I was more annoyed with my vendor and that bled over here.

TinCanTech

If your Vendor does not have OpenVPN 2.4 on their appliance yet
then they are not worth the money you give them ..

« Previous Page