I'm investigating behavior of SSL decryptors on OpenVPN connections to port 443 and I noticed that device I use as decryption proxy doesn't recognize OpenVPN connections as TLS thus doesn't decrypt them. The question is then - how does OpenVPN protocol differ from standard TLS?
Openvpn uses TLS for authentication and key exchange but it does not use it for the actual data encyption. When running on UDP openvpn runs the TLS session on top of a custom "reliability layer", i'm not sure what it does when running on TCP.
Furthermore an openVPN network uses it's own CA to authenticate both server and client certificates. So you can't subvert the certificate process by loading a cert into the OS certificate store.
OpenVPN provides different ways to management VPNs on your device. OpenVPN uses OpenSSL (a TLS implementation) to provide TLS tunneling. It simply uses the TLS protocol to establish a secure tunnel.
OpenVPN uses its own protocol to authenticate with an OpenVPN server, and manage connections. However, the actual tunnel is still a standard TLS session. The authentication is performed prior to establishing TLS. So your decryption proxy will not know what to do with these authentication type packets when its looking for straight TLS.
This is similar to how Tor uses TLS. Tor has its own protocol for establishing circuits and authenticating to Tor routers, but the TLS sessions are standard TLS between the routers. Decryption proxies won't know how to handle the Tor protocol that precedes the establishment of the TLS sessions.