OpenVPN throws a "signature digest algorithm too weak" error when I try to connect to a specific VPN.

A common suggestion for a workaround is using the following config:

tls-cipher "DEFAULT:@SECLEVEL=0"

This works, but I was unable to find any documentation about what SECLEVEL does. Does it just allow the less-secure cipher the VPN server offers? Or does it allow any cipher (eg also null cipher) or does it otherwise lead to a complete compromise of security?


1 Answer 1


From man 1 ciphers:

The cipher string @SECLEVEL=n can be used at any point to set the security level to n, which should be a number between zero and five, inclusive. See SSL_CTX_set_security_level for a description of what each level means.

And from man 3 SSL_CTX_set_security_level:

Level 0

Everything is permitted. This retains compatibility with previous versions of OpenSSL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.