---
title: 'Tutorial: Change the TLS Control Channel Security Setting'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--change-tls-control-channel-security/
product: Access Server Docs
description: Configure the TLS control channel security for VPN client connections with Access Server.
---

# Tutorial: Change the TLS Control Channel Security Setting

## Overview

You can configure the TLS control channel security in the Admin Web UI or the command line.

## Prerequisites

- An installed Access Server.
- Admin Web UI or console access with root privileges.

## Step 1: Understand the TLS control channel options

Access Server 3.0 uses **TLS Crypt** as the default security method for the TLS control channel. If the configuration key `vpn.server.tls_cc_security` is present in the configuration database, Access Server applies that setting. If it's not set, the server defaults to using TLs Crypt. The older key `vpn.server.tls_auth` is no onger used in version 3.0 and has no effect.

You can choose from these values:

- **none:** No additional signing or verification is done on packets.
- **tls-auth:** Uses a shared group key to sign and verify packets.
- **tls-crypt:** The same as tls-auth, but also encrypts the TLS control channel (default).
- **tls-cryptv2:** The same as above, but uses a per-client key instead of a shared group key.

> **Important**
>
> If the TLS control channel security is set to **tls-auth** or **tls-crypt** either explicitly or through a default setting, Access Server continues to generate new connection profiles with TLS Crypt v2 when possible and accepts connections from those profiles. This ensures Access Server continues to use TLS Crypt v2 and retains compatibility with TLS Auth or TLS Crypt for existing connection profiles or older OpenVPN client programs.

## Step 2 (option 1): Set the TLS control channel security in the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **VPN Server**.
   - The **Network Settings** tab displays.
3. Click the **Security / Encryption** tab.
4. Select the desired value under **TLS control channel security**.
5. Click **Save** and **Restart**.

## Step 2 (option 2): Set the TLS control channel security from the command line

1. Sign in to the console and get root privileges.
2. Set TLS Crypt v2 for the TLS control channel:

   ```
   sacli --key "vpn.server.tls_cc_security" --value "tls-cryptv2" ConfigPut
   sacli start
   ```

   - If you want to restore the default behavior, delete the configuration key:

     ```
     sacli --key "vpn.server.tls_cc_security" ConfigDel
     sacli start
     ```

## Consequences of changing the TLS control channel security setting

Changing the TLS control channel security settings for new Access Server installations won't likely impact existing VPN clients. For existing installations with many installed and configured VPN clients, changing the TLS control channel security setting without updating the connection profiles on the client devices may result in connection failures. Whether or not connection failures occur depends on the type of connection profiles used by the VPN clients. After changing the setting, VPN clients that can’t connect must get a new connection profile and/or update the VPN client software to a version that supports the TLS control channel security level.

### Compatibility of control channel security configured on Access Server with listed OpenVPN client programs

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| Client program used | Setting configured on Access Server |  |  |  |
|  | None | TLS Auth | TLS Crypt | TLS Crypt v2 |
| **Connect v3.2+** | **√** | **√** | **√** | **√** |
| **Connect v3 previous versions** | **√** | **√** | **√** | x |
| **Connect v2.7.111+** | **√** | **√** | **√** | **√** |
| **Connect v2 previous versions** | **√** | **√** | x | x |
| **Open source v2.5+** | **√** | **√** | **√** | **√** |
| **Open source v2.4** | **√** | **√** | **√** | x |
| **Open source v2 previous versions** | **√** | **√** | x | x |

> **Important**
>
> OpenVPN Connect v3.2 can use TLS Crypt v2 type connection profiles, but importing a profile from a URL from an Access Server that isn’t configured for TLS Crypt v2 control channel security results in an imported profile with that specific setting. OpenVPN Connect v3.3 and newer retrieves a TLS Crypt v2 connection profile if the server is Access Server 2.9 or newer when the **import from URL** function is used.

### Compatibility of control channel security setting configured on Access Server with listed connection profile types

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| Client profile | Setting configured on OpenVPN Access Server |  |  |  |
|  | none | TLS Auth | TLS Crypt | TLS Crypt v2 |
| **Any profile of type 'none'** | **√** | x | x | x |
| **Any profile of type 'tls-auth'** | x | **√** | x | x |
| **Any profile of type 'tls-crypt'** | x | x | **√** | x |
| **Any profile of type 'tls-cryptv2'** | x | **√** | **√** | **√** |
| **Server-locked from AS 2.8 or previous** | **√** | **√** | **√** | **√** |

> **Important**
>
> Server-locked profiles from Access Server 2.8 or older use the web service to retrieve a user-locked type profile from the server whenever that type of connection starts. Therefore, this type of connection profile can establish connections no matter the control channel security configuration setting. Newer, server-locked profiles from Access Server 2.9 work differently. They do not communicate through the web service but function as any other type of connection profile. An advantage of the newer server-locked connection profiles is that they can function with any client, not just OpenVPN Connect.

## Tip: Determine the TLS control channel security used in a connection profile

Access Server connection profiles are plain-text files that contain directives instructing the OpenVPN process how and where to connect. You can open these profiles in a text editor and refer to the directives below that define the control channel security behavior. In typical **.ovpn** profiles that contain inline certificates, the keys are stored in-line in text blocks in the connection profile itself. The directives may be presented in a slightly different form for externally referenced keys, referring to an external file containing that particular key. Below is an example of an externally referenced key, with the in-line versions commonly used with Access Server listed after.

An example of TLS Auth enabled using an externally referenced key:

```
tls-auth my_ta.key
```

And as an in-line parameter:

```
<tls-auth>
(The TLS Auth group key will be here.)
</tls-auth>
```

TLS Crypt in-line:

```
<tls-crypt>
(The TLS Crypt group key will be here.)
</tls-crypt>
```

TLS Crypt V2 in-line:

```
<tls-crypt-v2>
(The TLS Crypt v2 key will be here.)
</tls-crypt-v2>
```

Server-locked type profile:

```
setenv GENERIC_CONFIG
```

> **Note**
>
> If none of the directives **tls-auth**, **tls-crypt**, **tls-cryptv2**, or **setenv GENERIC\_CONFIG** exist in your connection profile, it doesn’t use additional control channel security. If **setenv GENERIC\_CONFIG** is present, it indicates that it is a server-locked profile that utilizes the web service to obtain a new connection profile each time the connection is established; therefore, it will simply use the setting your Access Server is configured to use.

---

Prev: [Tutorial: Change the Data-Channel Encryption Cipher](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-encryption-cipher.md)
Next: [Tutorial: Change the TLS Session Renegotiation Interval](https://openvpn.net/as-docs/v3/tutorials/tutorial--tls-session-renegotiation.md)
Index: https://openvpn.net/as-docs/llms.txt