Hello. I want to use TLSv1.3 TLS_AES_128_GCM-SHA256 openvpn tunnel. I try to set [code]tls-ciphersuites TLS_AES_128_GCM-SHA256[/code] on server side on Ubuntu 18.04. But nothing change and Control Channel stay: [code]TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384[/code] When I make same changes in client (Windows) config I have what I want [code]TLSv1.3, cipher TLSv1.3 TLS_AES_128_GCM_SHA256[/code] But in this case, I will not be able to control clients from the server side if in the future I change my decision. Is there a way to change the tls-ciphersuites clients from the server side?

I think you need to specify --tls-version-min 1.3

[quote=SerGay post_id=95246 time=1604164318 user_id=48659] Hello. I want to use TLSv1.3 TLS_AES_128_GCM-SHA256 openvpn tunnel. I try to set [code]tls-ciphersuites TLS_AES_128_GCM-SHA256[/code] [/quote]

[quote=TinCanTech post_id=95259 time=1604252518 user_id=37053] I think you need to specify --tls-version-min 1.3 [/quote] Nope. It won't help. The control channel is already using tls 1.3. Perhaps I asked the question incorrectly. I'll try to clarify. I just want to be able to control the TLS 1.3 encryption mode from the server side, as it can be done with TLS 1.2 using the --tls-cipher option.

Like this: 2020-11-01 17:40:20 us=52256 0.0.0.0:3554 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_128_GCM_SHA256, 384 bit EC, curve: secp384r1

[quote=SerGay post_id=95246 time=1604164318 user_id=48659] Is there a way to change the tls-ciphersuites clients from the server side? [/quote]Do you mean for the server to control the client TLS cipher/ciphersuite, like auto-negotiate ?

[quote=TinCanTech post_id=95286 time=1604344002 user_id=37053] Like this: 2020-11-01 17:40:20 us=52256 0.0.0.0:3554 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_128_GCM_SHA256, 384 bit EC, curve: secp384r1 [/quote] Yes. But i use RSA. [quote=TinCanTech post_id=95288 time=1604344234 user_id=37053] Do you mean for the server to control the client TLS cipher/ciphersuite, like auto-negotiate ? [/quote] Yep. When I used openvpn on ubuntu 16.04 and older without built-in support for TLS 1.3 to set the encryption mode to TLS 1.2, I added the line --tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 to the server configuration and it was automatically distributed to the client. Those. the client understood that a similar set of TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 should be used instead of the default TLS-DHE-RSA-WITH-AES-256-GCM-SHA384. With TLS 1.3 this does not work from the server side and only works from the client side. That is, by specifying --tls-ciphersuites TLS_AES_128_GCM-SHA256 in the server configuration, the selection priority is given to the client, and the mode remains TLS_AES_256_GCM-SHA384. I do not know how else to explain to make it clear.

[quote=SerGay post_id=95292 time=1604345825 user_id=48659] I do not know how else to explain to make it clear. [/quote]Your complete explanation is more clear. The problem you face is that TLS cipher configuration is complex and there is only so much that Openvpn (Free Open Source Software) can do .. You could raise this as a feature request ? It is most likely that SSL libraries will pickup TLS 1.3 as they become ready .. Edit: After testing, the problem you face [i]could be[/i] that the client side does not support 1.3 .. it works for me.

[quote=TinCanTech post_id=95296 time=1604354930 user_id=37053] Edit: After testing, the problem you face [i]could be[/i] that the client side does not support 1.3 .. it works for me. [/quote] Have you read my very first post? The connection is established with the [u]TLSv1.3[/u], cipher TLSv1.3 TLS_AES_256_GCM_SHA384 and I am trying to do [u]TLSv1.3[/u], cipher TLSv1.3 TLS_AES_128_GCM_SHA256. How to put it mildly ... Don't you think that the client still supports TLS 1.3? And the problem is not in the client. The server allows the client to connect with a set of ciphers that it (the server) has not explicitly set.

Like I said: It works for me. I have not tested with Windows, maybe Windows version does not support this yet ?

Client and server must be the same version and if you specify ciphers it should be the same. But if you can't update client and only from server so it automatically choose the same ciphers on server and client if client is older version there is no way to set ciphers from server On my android phone i set this one and have ecc Run very like tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 tls-cipher TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 ecdh-curve secp521r1

tls-ciphersuites not working on server side

SerGay

TinCanTech wrote Correct, I did not change anything in the client config.

Well, then I definitely don't understand anything)
If everyone works, but for some reason I don't.

By the way, the client on Android also does not accept this setting in the server configuration.

tls-ciphersuites TLS_AES_128_GCM_SHA256

So it's not about Windows.

300000

Oh you try it on android and expect it work on every device the same . On my androi it can supposed up to

TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, 521 bit EC, curve: secp521r1

So nothing it cant do but there is something you can't make it work so let it is as that.

TinCanTech

I am using Linux server, openvpn 2.5.0 and Windows client openvpn 2.5.0 and it works for me.

I would need to see some logs to be able to help you further.

SerGay

Thank you all for participating and for putting up with my nagging for so long.

Tests have shown that there is no problem on Ubuntu 20.04. The server processes the line "tls-ciphersuites" correctly and does not allow clients to connect if they have specified something else in their configuration.
The problem in Ubuntu 18.04 is most likely related to the OpenSSL version, despite the fact that support for encryption mode controls "tls-ciphersuites" is declared by the developers even in this version.
I don’t want to make forecasts, but with the release of the updated OpenSSL package, the problem will most likely go away.

Thanks again to everyone.

300000

your openvpn version is 2.4.4 so it not support "tls-ciphersuites" if you can upgate to 2.4.7 it work ok . you said you update openvpn 2.5 but when i try it on unbutu running version 2.4.4 it not work but when i try it on raspberry running 2.4.7 it work on setting tls-cipher on server side.

SerGay

300000 wrote your openvpn version is 2.4.4 so it not support "tls-ciphersuites" if you can upgate to 2.4.7 it work ok . you said you update openvpn 2.5 but when i try it on unbutu running version 2.4.4 it not work but when i try it on raspberry running 2.4.7 it work on setting tls-cipher on server side.

I have version of OpenVPN 2.5.0 on Ubuntu 18.04 because the official repository is connected;)
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

p.s. If you add the tls-ciphersuites line to the 2.4.4 server configuration, it won't start at all.

p.p.s. tls-cipher and tls-ciphersuites are not the same. The first manages for TLS 1.2, the second for TLS 1.3. tls-cipher accepts even OpenVPN 2.3.

300000

SerGay wrote
300000 wrote your openvpn version is 2.4.4 so it not support "tls-ciphersuites" if you can upgate to 2.4.7 it work ok . you said you update openvpn 2.5 but when i try it on unbutu running version 2.4.4 it not work but when i try it on raspberry running 2.4.7 it work on setting tls-cipher on server side.
I have version of OpenVPN 2.5.0 on Ubuntu 18.04 because the official repository is connected;)
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

p.s. If you add the tls-ciphersuites line to the 2.4.4 server configuration, it won't start at all.

p.p.s. tls-cipher and tls-ciphersuites are not the same. The first manages for TLS 1.2, the second for TLS 1.3. tls-cipher accepts even OpenVPN 2.3.

that is why i said i try tls-ciphersuites on version 2.4.4 on unbutu and openvpn cant start but it can start on openvpn 2.4.7 on raspberry, i have odroid n2 running unbutu 18.4 and openvpn 2.4.4 but cant add tls-ciphersuites?

« Previous Page