Hi, On 07/07/16 09:15, Steffan Karger wrote: > Hi Scott, > > On Wed, Jul 6, 2016 at 9:18 PM, Scott Crooks <[email protected]> wrote: >> I saw this file in the OpenVPN codebase: >> https://github.com/OpenVPN/openvpn/blob/master/README.ec >> >> Which claims that support for elliptic curve certificates will be enabled in >> OpenVPN 2.4.0. Just wanting to make sure there wasn't another way to enable >> it in version 2.3.10? > Yes, use an mbed TLS build. That will automatically support ECDSA and > ECDH. I *think* (can't test right now) that ECDSA also works fine > with 2.3.10 + modern OpenSSL (1.0.1+, iirc). ECDH might also work > with OpenSSL 1.0.2+. > > But, by far the easiest way is to just use the master branch. It is > quite stable, and has full EC support, for both mbed TLS and OpenSSL. > > I concur mostly with Steffan, with a few notes:
- with mbed TLS ECDSA works "out of the box" - with OpenSSL, you need a version that supports it; notably, RedHat strips ALL elliptic curve support from their supplied versions of openssn - then, in order to use ECDSA certs it is best to run the master branch on the server, as you will need to specify a ecdh-curve parameter in order to use SHA2+ECDSA. - for the *client* you can stick with 2.3.10+ as long as the OpenSSL lib supports EC. HTH, JJK ------------------------------------------------------------------------------ Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San Francisco, CA to explore cutting-edge tech and listen to tech luminaries present their vision of the future. This family event has something for everyone, including kids. Get more information and register today. http://sdm.link/attshape _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
