Re: [Openvpn-devel] [PATCH v4] Add insecure tls-cert-profile options

2021-10-29 Thread Max Fillinger
On 29/10/2021 13:24, Arne Schwabe wrote: The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add insecure as option to tls-cert-profile to allow sett

[Openvpn-devel] [PATCH v4] Add insecure tls-cert-profile options

2021-10-29 Thread Arne Schwabe
The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add insecure as option to tls-cert-profile to allow setting a seclevel of 0. Patch v4: fix default