2


most of my question are already answered by reading in this forum, but "one last thing" is still open.

I am running a OpenVPN server with the following security characters:

SERVER (Raspbian Buster)
auth SHA512
auth-nocache
remote-cert-tls client
user openvpn
group openvpn
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
tls-crypt /etc/openvpn/server/ta.key
dh none
ecdh-curve brainpoolP512r1
tls-version-min 1.2
cipher AES-256-GCM
ncp-ciphers AES-256-GCM:AES-256-CBC

CLIENT (iPhone App)
tls-version-min 1.2
remote-cert-tls server
auth SHA512
cipher AES-256-GCM
auth-nocache

Everything works fine so far and the client can connect. But the missing link is the tls-cipher. With the following cipher my server starts, but the client cannot connect - of course I used the same ciphers for server and client.

tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256

The result is the following server status:

TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive.
OpenSSL: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher TLS_ERROR: BIO read tls_read_plaintext error
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed

I tried some more tls-cipher like

tls-cipher TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
but the server did not start with that configuration.

Which tls-cipher can be used for client and server?

Improve this question
3
  • 2
    You want ECDHE, not DHE, and you want Curve25519 / X25519, not brainpool. The cipher suite name part that is RSA or ECDSA must match the type of key in the certificate you're using. You want GCM and you don't want CBC. Also, do you need to specify the cipher list using openssl names or RFC names? See openssl.org/docs/man1.1.1/man1/ciphers.html
    – Z.T.
    Commented Apr 6, 2020 at 14:42
  • Ok, so I assumed the ecdh-curve and the cipher have to match, but did not find any information so far. Could you please give me a concrete example of a very secure curve and cipher, which would work?
    – meltinsands
    Commented Apr 6, 2020 at 16:16
  • The best recommendation is ECDHE with X25519, RSA (2048 is big enough), AES GCM (128 is enough). Use chacha20poly1305 on mobile devices without hardware AES.
    – Z.T.
    Commented Apr 6, 2020 at 16:20

1 Answer 1

Reset to default
2

You need to change the right portion of your cipher spec. In TLS 1.2 the cipher spec contains several parts corresponding to different settings:

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  • The first part is obvious: this is TLS
  • The second part (ECDHE or DHE) defines the key exchange used: elliptic curve based diffie-hellman or "normal" RSA based diffie-hellman (it also can be omitted to disable forward secrecy, but don't do that)
  • The next part tells which key type the certificate uses, it can be ECDSA for an elliptic curve or RSA for an rsa key, you must pecify the right one that corresponds to your certificate key
  • the remaining parts after the WITH define which symmetric cypher to use once authentication and key exchange are done. In this example it uses 128bit AES in CBC mode with SHA256 for message authentication. You should use AES in GCM mode wherever possible because it does encryption and authentication in one step rather than using a separate MAC.

Using that knowledge it becomes clear that you have to use at least something like

tls-cipher TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .