Hi,

On 07/07/16 09:15, Steffan Karger wrote:
> Hi Scott,
>
> On Wed, Jul 6, 2016 at 9:18 PM, Scott Crooks <[email protected]> wrote:
>> I saw this file in the OpenVPN codebase:
>> https://github.com/OpenVPN/openvpn/blob/master/README.ec
>>
>> Which claims that support for elliptic curve certificates will be enabled in
>> OpenVPN 2.4.0. Just wanting to make sure there wasn't another way to enable
>> it in version 2.3.10?
> Yes, use an mbed TLS build.  That will automatically support ECDSA and
> ECDH.  I *think* (can't test right now) that ECDSA also works fine
> with 2.3.10 + modern OpenSSL (1.0.1+, iirc).  ECDH might also work
> with OpenSSL 1.0.2+.
>
> But, by far the easiest way is to just use the master branch.  It is
> quite stable, and has full EC support, for both mbed TLS and OpenSSL.
>
>
I concur mostly with Steffan, with a few notes:

- with mbed TLS ECDSA works "out of the box"
- with OpenSSL, you need a version that supports it; notably, RedHat 
strips ALL elliptic curve support from their supplied versions of openssn
- then, in order to use ECDSA certs it is best to run the master branch 
on the server, as you will need to specify a ecdh-curve parameter in 
order to use SHA2+ECDSA.
- for the *client* you can stick with 2.3.10+ as long as the OpenSSL lib 
supports EC.

HTH,

JJK


------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

Reply via email to