Tutorial: Change the TLS Control Channel Security Setting⁠

• An installed Access Server.

• Admin Web UI or console access with root privileges.

Access Server 3.0 uses TLS Crypt as the default security method for the TLS control channel. If the configuration key vpn.server.tls_cc_security is present in the configuration database, Access Server applies that setting. If it's not set, the server defaults to using TLs Crypt. The older key vpn.server.tls_auth is no onger used in version 3.0 and has no effect.

You can choose from these values:

• none: No additional signing or verification is done on packets.

• tls-auth: Uses a shared group key to sign and verify packets.

• tls-crypt: The same as tls-auth, but also encrypts the TLS control channel (default).

• tls-cryptv2: The same as above, but uses a per-client key instead of a shared group key.

1. Sign in to the Admin Web UI.

2. Click VPN Server.

   • The Network Settings tab displays.

3. Click the Security / Encryption tab.

4. Select the desired value under TLS control channel security.

5. Click Save and Restart.

1. Sign in to the console and get root privileges.

2. Set TLS Crypt v2 for the TLS control channel:

   sacli --key "vpn.server.tls_cc_security" --value "tls-cryptv2" ConfigPut
   sacli start

   • If you want to restore the default behavior, delete the configuration key:

     sacli --key "vpn.server.tls_cc_security" ConfigDel
     sacli start

Changing the TLS control channel security settings for new Access Server installations won't likely impact existing VPN clients. For existing installations with many installed and configured VPN clients, changing the TLS control channel security setting without updating the connection profiles on the client devices may result in connection failures. Whether or not connection failures occur depends on the type of connection profiles used by the VPN clients. After changing the setting, VPN clients that can’t connect must get a new connection profile and/or update the VPN client software to a version that supports the TLS control channel security level.

Access Server connection profiles are plain-text files that contain directives instructing the OpenVPN process how and where to connect. You can open these profiles in a text editor and refer to the directives below that define the control channel security behavior. In typical .ovpn profiles that contain inline certificates, the keys are stored in-line in text blocks in the connection profile itself. The directives may be presented in a slightly different form for externally referenced keys, referring to an external file containing that particular key. Below is an example of an externally referenced key, with the in-line versions commonly used with Access Server listed after.

An example of TLS Auth enabled using an externally referenced key:

tls-auth my_ta.key

And as an in-line parameter:

<tls-auth>
(The TLS Auth group key will be here.)
</tls-auth>

TLS Crypt in-line:

<tls-crypt>
(The TLS Crypt group key will be here.)
</tls-crypt>

TLS Crypt V2 in-line:

<tls-crypt-v2>
(The TLS Crypt v2 key will be here.)
</tls-crypt-v2>

Server-locked type profile:

setenv GENERIC_CONFIG