Hi all,
Recently we have been receiving numerous reports that the latest Connect client versions (macOS 3.9.1; Android 3.72; iOS 3.7.4) fail to connect to OpenVPN servers on old TP-Link routers (Archer C1200, ARCHER c9, etc...)
A TLS handshake failure is happening due to the server on the old TP-Link routers utilising outdated SSL libraries such as PolarSSL 1.2 when facing connection from clients that use modern SSL libraries such as OpenSSL 3.5
Workaround
Open your .ovpn profile in texteditor
Add the following linetls-groups X25519:secp256r1
Reimport the profile into your client app again and try to connect
In detail, PolarSSL fails to parse the initial ClientHello packet due to it being above 512 bytes large.
This workaround removes the post-quantum group that is advertised by default by lates OpenSSL versions, which in return reduces the initial ClientHello packet size making the TLS handshake and subsequent connections possible.
Hope you found this workaround helpful.
But ultimately, my recommendation would be to replace your routers, since the OpenVPN server versions on them are severely outdated with multitudes of security vulnerabilities that otherwise have been patched out over the years with more recent OpenVPN versions.
With Regards,
JosephS
