Re: Compatibility from openvpn 2.4 to 2.7

--===============1208787376641208078==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="cuvZuEAMgVU5bA2S"
Content-Disposition: inline


--cuvZuEAMgVU5bA2S
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

On Thu, Oct 16, 2025 at 11:53:51AM +0200, Simon Matter via Openvpn-users wr=
ote:
> I'm trying to upgrade an old openvpn 2.4 based vpn to 2.7.
> The old systems do have openssl 1.x while the new systems on AlmaLinux 10
> will have openssl 3.2.2.

OpenSSL 3.x is much strikter regarding "outdated crypto", so certficates
based on MD5 or SHA1 hash are refused by default.

Try adding "tls-cert-profile legacy" or "tls-cert-profile insecure" to
your config and see if that makes it work (this enables SHA1 and MD5
support).

The error message you see is not the "typical" one, normally it says
something like "MD too weak" in this case.  But it might still help.

gert
--=20
"If was one thing all people took for granted, was conviction that if you=
=20
 feed honest figures into a computer, honest figures come out. Never doubte=
d=20
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistre=
ss

Gert Doering - Munich, Germany                             [email protected]=
=2Ede

--cuvZuEAMgVU5bA2S
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQGcBAEBAgAGBQJo8MITAAoJEB2Cnv7KVigSHF0MAIojWGHmjIy9Gp+YUukt5e3k
7HXpQOlwl7cPk3XlwgShzADwd68JAGpkdYurdJeTOhk99THdf9MWaxncL1frd/4L
mUyAX7wrvVk9Qev2qtmU2Fi8+Mn1Rh1Ca73EkXN/MIGciIxTlVzW6Qg4nOfR1nvZ
Ynh2g+jZHJMw/66BbI1E6Ud9Gi07v1QSGFD/aj8oFGTdKLQHk5HV/sc8DkEhcf1a
fnYrnX/CVAH44jueUdDjQaFaUyzdl2y1dp7UED2AmuyMACiZJZh7erKWajrMQRre
a75xZYRP5POPbXqbogoPyuVtshWAyKRqLSjvtwjz7d43Sy0UEqjVZ2lI2xHTJSE6
iyejZ2+s6OazBKUDL4A1kjQi92a66Yhw0jjg12Kn9ZdzOqK/21XdFDucvQoATFaq
wKVMbD6OQGMTANSVsBinvWox0pJeJWVVe/p8f/C3ZFw6MO6yM9O9Gtvp7FvQscLl
UMDW11annoucW3XcqkoiKcTnpJGbb3mt+3hafSx78Q==
=NIdW
-----END PGP SIGNATURE-----

--cuvZuEAMgVU5bA2S--


--===============1208787376641208078==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1208787376641208078==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

--===============1208787376641208078==--