Tutorial: Change the TLS Control Channel Security Setting⁠

Beginning in Access Server 2.9.0, TLS Crypt is the default TLS control channel security setting. Prior versions of Access Server set TLS Auth as the default. OpenVPN Access Server 2.8 and previous use the configuration key vpn.server.tls_auth to turn on or off the additional TLS control channel security using the TLS Auth method. When Access Server 2.9.0 or newer detects the presence of this configuration value in your configuration database, it adheres to that setting. However, if the configuration value vpn.server.tls_cc_security is present, that takes precedence. If neither key is present, the default TLS Crypt setting applies.

You can choose from these values:

• none: No additional signing or verification is done on packets.

• tls-auth: Uses a shared group key to sign and verify packets.

• tls-crypt: The same as tls-auth, but also encrypts the TLS control channel (default).

• tls-cryptv2: The same as above, but uses a per-client key instead of a shared group key.

1. Sign in to Admin Web UI.

2. Select Configuration → Advanced VPN,

3. Select the desired value under TLS Control Channel Security and set it to Yes.

4. Select Save Settings and Update Running Server.

1. Sign in to the console and get root privileges.

2. Switch to the scripts directory:

   cd /usr/local/openvpn_as/scripts/

3. Set TLS Crypt v2 for the TLS control channel:

   ./sacli --key "vpn.server.tls_cc_security" --value "tls-cryptv2" ConfigPut
   ./sacli start

   • If you want to restore the default behavior, delete the configuration key:

     ./sacli --key "vpn.server.tls_cc_security" ConfigDel
     ./sacli start

1. Sign in to the console and get root privileges.

2. Switch to the scripts directory:

   cd /usr/local/openvpn_as/scripts/

3. Set TLS Auth (default) for the TLS control channel:

   ./sacli --key "vpn.server.tls_auth" --value "true" ConfigPut
   ./sacli start

   • If you want to disable TLS Auth:

     ./sacli --key "vpn.server.tls_auth" --value "false" ConfigPut
     ./sacli start

Changing the TLS control channel security settings for new Access Server installations won't likely impact existing VPN clients. For existing installations with many installed and configured VPN clients, changing the TLS control channel security setting without updating the connection profiles on the client devices may result in connection failures. Whether or not connection failures occur depends on the type of connection profiles used by the VPN clients. After changing the setting, VPN clients that can’t connect must get a new connection profile and/or update the VPN client software to a version that supports the TLS control channel security level.

Access Server connection profiles are plain-text files that contain directives instructing the OpenVPN process how and where to connect. You can open these profiles in a text editor and refer to the directives below that define the control channel security behavior. In typical .ovpn profiles that contain inline certificates, the keys are stored in-line in text blocks in the connection profile itself. The directives may be presented in a slightly different form for externally referenced keys, referring to an external file containing that particular key. Below is an example of an externally referenced key, with the in-line versions commonly used with Access Server listed after.

An example of TLS Auth enabled using an externally referenced key:

tls-auth my_ta.key

And as an in-line parameter:

<tls-auth>
(The TLS Auth group key will be here.)
</tls-auth>

TLS Crypt in-line:

<tls-crypt>
(The TLS Crypt group key will be here.)
</tls-crypt>

TLS Crypt V2 in-line:

<tls-crypt-v2>
(The TLS Crypt v2 key will be here.)
</tls-crypt-v2>

Server-locked type profile:

setenv GENERIC_CONFIG