Security Advisory

TLS 1.0 and 1.1 web services deprecation notice

Description:

Starting 20th of January 2023 we will begin turning off support for TLS 1.0 and TLS 1.1 connections on our website and web download services. TLS 1.2 or higher will be required to make a connection, as that is currently considered secure and supported by almost all software. TLS 1.0 and TLS 1.1 have already been deprecated for a while, but support was kept for some time to allow people the opportunity to upgrade to software that supports TLS 1.2 or higher. To be clear, this change does not affect VPN services, and it does not affect self-hosted solutions like OpenVPN Access Server. It only affects web traffic to the specified sites below.

These are the affected services where TLS 1.0 and TLS 1.1 will be turned off:

  • https://openvpn.net (and .com) - the main OpenVPN website
  • https://cloud.openvpn.com - the CloudConnexa website
  • https://swupdate.openvpn.net (and .org) - file download server for OpenVPN software
  • https://as-repository.openvpn.net - the Access Server software repository

Resolution:

We don't anticipate any problems for our customers and visitors that requires any resolution. TLS 1.2 and higher have been supported and standardized for many years now.

Should you however find yourself in the rare position of being unable to visit or access our web services due to this change, it is almost certainly caused by the use of software that is outdated and out of support. In such a case we would strongly recommend to update the software to ensure it can support TLS 1.2 or higher.