Hello ketues,
VPN encryption is not an easy subject but here are a few things I know about this situation;
OpenVPN can use certificates to do identity verification. Basically the certificates provide a way to prove who you are. The certificate infrastructure starts with a private key for the certificate authority (CA), and a CA certificate signed with that. When a client or server certificate is generated this is done by creating a certificate signing request first and then having the CA sign it. That signing process is these days normally done using sha256. In the past it used to be sha1, or before that, md5. This is the situation you're in, since OpenVPN is complaining that the CA is signed with MD, which is not safe anymore. There is no way to easily fix this. You should just start a new certificate structure and this time make it use either secp384r1 or rsa2048 with sha256.
The server configuration you mention is about the handshake and encryption, and is less than ideal. You have chosen to use AES-256-CBC with a separate step to sign and verify each packet that gets sent and received by the OpenVPN tunnel processes. In theory this is great but there are a few problems. First off you can use AES-256-GCM, and hopefully your OpenVPN clients will switch to that automatically, if they can. With AES-256-GCM, the step of encrypting and then signing the packets is done in one phase instead of two separate ones. This is more efficient, while keeping the same level of encryption strength. Another point is that you have chosen to do sha512 for the separate signing and verification step. This is unnecessarily strong and actually can slow things down significantly.
People tend to think stronger is always better, but this is not always the case, especially when it's only used for an HMAC, where, ironically, MD5 is actually still fine to use for the packet signing and verifying, unlike with the certificate signatures, where the strength really does matter.
See also this article why MD5 support is removed;
https://openvpn.net/faq/md5-signature-a ... m-support/
I am sorry to hear that your ASUS-RT router, despite being fairly new, is apparently still using MD5 signed certificates. I understand that you can't fix their mistake.
You keep referring to a '2.7' client, I must assume this is OpenVPN Connect v2.7 which is deprecated. Sorry to say, but, this was only ever made for Windows and macOS, there is no Linux version. Since it is deprecated and not being updated anymore, this is the reason why such outdated security is still allowed on that older client. On newer versions by default it is not. For Linux there is open source community OpenVPN2 linux software at this address;
https://community.openvpn.net/openvpn/w ... twareRepos
There is a special flag in OpenVPN for setting the security level of the certificates being used which could still allow MD5 signed certificates to be used. I am not guaranteeing success but you could try adding this to the client profile:
tls-cert-profile insecure
The tls-cert-profile insecure setting is the least secure option.
Kind regards,
Johan