Public bug reported:
Release: Ubuntu 24.04.1 LTS
openvpn:
Installed: 2.6.12-0ubuntu0.24.04.1
Expected behavior: Using a configuration that includes "providers tpm2"
and which utilizes a TPM-sealed private key (TSS2), the VPN client
should start normally.
Observed behavior: VPN client fails to start with the following errors
(--verb 5)
OpenSSL: error:0308010C:digital envelope routines::unsupported:Global default
library context, Algorithm (TLS1-PRF : 0), Properties (<null>)
OpenSSL: error:0308010C:digital envelope routines::unsupported:Global default
library context, Algorithm (id-aes256-GCM : 7), Properties (<null>)
Cipher algorithm 'AES-256-GCM' not found
Unsupported cipher in --data-ciphers: AES-256-GCM
OpenSSL: error:0308010C:digital envelope routines::unsupported:Global default
library context, Algorithm (id-aes128-GCM : 25), Properties (<null>)
Cipher algorithm 'AES-128-GCM' not found
Unsupported cipher in --data-ciphers: AES-128-GCM
Options error: --data-ciphers list contains unsupported ciphers or is too long.
===
The "OpenSSL3" patch that had been carried up through 2.5 was dropped
early in the 2.6 cycle. However, when OpenVPN is combined with the
tpm2-openssl module, it exhibits similar behavior to 2.5 without the
patch (algorithms fail to load). I surmise that this is because TPM2
hardware still supports algorithms that OpenSSL 3.x considers "legacy".
My testing shows that if the previous "OpenSSL3.patch" is restored,
openvpn works with tpm2-openssl.
** Affects: openvpn (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2089270
Title:
Still need OpenSSL3 patch for tpm2
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/2089270/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
