as a follow up : try applying the following patch to the openssl 1.0.0d code base, recompile openssl, relink openvpn against it and now run
./openvpn --show-digests
this seemed to work for my test setup using
./openvpn --config ... --auth ecdsa-with-SHA256
--- ./crypto/evp/m_ecdsa.c 2006-04-19 19:05:57.000000000 +0200
+++ ../openssl-1.0.0d-sha256/./crypto/evp/m_ecdsa.c 2011-08-31 16:29:24.000000000 +0200
@@ -146,3 +146,62 @@
return(&ecdsa_md);
}
#endif
+
+#ifndef OPENSSL_NO_SHA256
+static int init224(EVP_MD_CTX *ctx)
+ { return SHA224_Init(ctx->md_data); }
+static int init256(EVP_MD_CTX *ctx)
+ { return SHA256_Init(ctx->md_data); }
+
+static int update224(EVP_MD_CTX *ctx,const void *data,size_t count)
+ { return SHA224_Update(ctx->md_data,data,count); }
+static int update256(EVP_MD_CTX *ctx,const void *data,size_t count)
+ { return SHA256_Update(ctx->md_data,data,count); }
+
+static int final224(EVP_MD_CTX *ctx,unsigned char *md)
+ { return SHA224_Final(md,ctx->md_data); }
+static int final256(EVP_MD_CTX *ctx,unsigned char *md)
+ { return SHA256_Final(md,ctx->md_data); }
+
+static const EVP_MD ecdsa_sha224_md=
+ {
+ NID_ecdsa_with_SHA224,
+ NID_ecdsa_with_SHA224,
+ SHA224_DIGEST_LENGTH,
+ EVP_MD_FLAG_PKEY_DIGEST,
+ init224,
+ update224,
+ final224,
+ NULL,
+ NULL,
+ EVP_PKEY_ECDSA_method,
+ SHA256_CBLOCK,
+ sizeof(EVP_MD *)+sizeof(SHA256_CTX),
+ };
+
+const EVP_MD *EVP_ecdsa_sha224(void)
+ {
+ return(&ecdsa_sha224_md);
+ }
+
+static const EVP_MD ecdsa_sha256_md=
+ {
+ NID_ecdsa_with_SHA256,
+ NID_ecdsa_with_SHA256,
+ SHA256_DIGEST_LENGTH,
+ EVP_MD_FLAG_PKEY_DIGEST,
+ init256,
+ update256,
+ final256,
+ NULL,
+ NULL,
+ EVP_PKEY_ECDSA_method,
+ SHA256_CBLOCK,
+ sizeof(EVP_MD *)+sizeof(SHA256_CTX),
+ };
+
+const EVP_MD *EVP_ecdsa_sha256(void)
+ {
+ return(&ecdsa_sha256_md);
+ }
+#endif
--- ./ssl/ssl_algs.c 2010-04-07 15:18:30.000000000 +0200
+++ ../openssl-1.0.0d-sha256/./ssl/ssl_algs.c 2011-08-31 16:22:41.000000000 +0200
@@ -122,6 +122,10 @@
#ifndef OPENSSL_NO_ECDSA
EVP_add_digest(EVP_ecdsa());
#endif
+#if !defined(OPENSSL_NO_SHA256) && !defined(OPENSSL_NO_ECDSA)
+ EVP_add_digest(EVP_ecdsa_sha224());
+ EVP_add_digest(EVP_ecdsa_sha256());
+#endif
/* If you want support for phased out ciphers, add the following */
#if 0
EVP_add_digest(EVP_sha());
