Project

General

Profile

Actions
Copy link

Todo #13255

closed
JP JP

Set PKCS#12 algorithm when exporting OpenVPN ZIP or Windows bundles

Todo #13255: Set PKCS#12 algorithm when exporting OpenVPN ZIP or Windows bundles

Added by Jim Pingle over 4 years ago. Updated about 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
OpenVPN Client Export
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:

Description

Currently when crafting a PKCS#12 archive the OpenVPN Client Export package does not set a specific encryption algorithm, so it ends up using the current default in OpenSSL 1.1.1 which is RC2. OpenSSL 3.0 is dropping support for RC2, and given its weakness we should be exporting using something stronger anyhow.

The package should set AES-256 by passing -certpbe AES-256-CBC -keypbe AES-256-CBC when creating the PKCS#12 file, perhaps with an option to omit them so it uses the old algorithms for legacy clients.

Related issues 1 (0 open — 1 closed)

Related to Todo #13917: OpenVPN Client Export: Integrate OpenVPN 2.6.0ResolvedJim Pingle

Actions

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #1

  • Description updated (diff)

TW Updated by Thomas Ward over 3 years ago Actions
Copy link
 #3

Jim Pingle wrote:

Currently when crafting a PKCS#12 archive the OpenVPN Client Export package does not set a specific encryption algorithm, so it ends up using the current default in OpenSSL 1.1.1 which is RC2. OpenSSL 3.0 is dropping support for RC2, and given its weakness we should be exporting using something stronger anyhow.

The package should set AES-256 by passing -certpbe AES-256-CBC -keypbe AES-256-CBC when creating the PKCS#12 file, perhaps with an option to omit them so it uses the old algorithms for legacy clients.

Borrowing from comments/logs in #13257 but, could we do something similar here to what was done for general PKCS#12 exports?

Added an option to change the encryption level to high (AES-256+SHA256), low (3DES+SHA1), and legacy (RC2-40 + SHA1). Most things non-macOS are good with "high", and macOS is happy with "low". Anything even older can use "legacy".

This way, we can still use the "lower" security that is required/present for "older" things (a-la Macs) and default to "high" unless selected by admin/exporter in the UI.

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #4

That is part of the plan, see #13917

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #5

  • Related to Todo #13917: OpenVPN Client Export: Integrate OpenVPN 2.6.0 added

JP Updated by Jim Pingle about 3 years ago Actions
Copy link
 #6

  • Status changed from New to In Progress

JP Updated by Jim Pingle about 3 years ago Actions
Copy link
 #7

  • Status changed from In Progress to Feedback
  • % Done changed from 0 to 100

Included in OpenVPN client export package 1.9. Will be in snapshots for testing, then release branches if it tests OK.

JP Updated by Jim Pingle about 3 years ago Actions
Copy link
 #8

  • Status changed from Feedback to Resolved

This has been available for Plus 23.05.1 and CE 2.7.0 for several days with no reports of trouble.

We can open new issues as needed should problems arise.

Actions
Copy link

Also available in: Atom