Table comparing the complete list of all OpenVPN versions. See below for pertinent notes.
| OpenVPN Version Matrix | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| OVPN | Release Date | TLS/SSL | Ciphers | Keys | Open SSL2 | Polar SSL (mbed)2 | |||||
| TLS | Neg1 | BF | DES | HMAC | AES | SHA | ECDH (A|E) |
||||
| 3.x3 | -- | 1.3 | Yes | No | No | No | 256 | 512 | Yes | 1.0.2 | 2.4.x |
| 2.4.8 | 10.31.2019 | 1.34 | Yes | No | No | No | 256 | 512 | Yes | Any | 2.0.0 |
| 2.4.7 | 02.18.2019 | 1.34 | Yes | No | No | No | 256 | 512 | Yes | Any | 2.0.0 |
| 2.4.6 | 04.19.2018 | 1.2 | Yes | No | No | No | 256 | 512 | Yes | Any | 2.0.0 |
| 2.4.5 | 02.28.2018 | 1.2 | Yes | No | No | No | 256 | 512 | Yes | Any | 2.0.0 |
| 2.4.4 | 09.25.2017 | 1.2 | Yes | No | No | No | 256 | 384 | Yes | Any | 2.0.0 |
| 2.4.3 | 06.21.2017 | 1.2 | Yes | No | No | No | 256 | 384 | Yes | Any | 1.3.85 |
| 2.4.2 | 05.11.2017 | 1.2 | Yes | No | No | No | 256 | 384 | Yes | Any | 1.3.85 |
| 2.4.1 | 03.21.2017 | 1.2 | Yes | No | No | No | 256 | 384 | Yes | Any | 1.3.85 |
| 2.4.0 | 12.26.2016 | 1.2 | Yes | No | No | No | 256 | 384 | Yes | 0.9.8 | 1.3.85 |
| 2.3.18 | 09.25.2017 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.17 | 06.21.2017 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.16 | 05.18.2017 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.15 | 05.11.2017 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.14 | 12.06.2016 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.13 | 11.02.2016 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.12 | 08.23.2016 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.11 | 05.09.2016 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.10 | 01.04.2016 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | Any | 1.3.0 |
| 2.3.9 | 12.15.2015 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.2 | 1.2.10 |
| 2.3.8 | 08.03.2015 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.7 | 06.02.2015 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.6 | 11.28.2014 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.5 | 10.24.2014 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.4 | 04.30.2014 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.3 | 04.08.2014 | 1.2 | Yes | Yes | Yes | Yes | 256 | 384 | No | 1.0.1 | 1.2.10 |
| 2.3.2 | 05.31.2013 | 1.0 | No | Yes | Yes | Yes | 256 | SHA1 | No | 1.0.0 | 1.2.0 |
| 2.3.1 | 03.29.2013 | 1.0 | No | Yes | Yes | Yes | 256 | SHA1 | No | 1.0.0 | 1.2.0 |
| 2.3.0 | 01.07.2013 | 1.0 | No | Yes | Yes | Yes | 256 | SHA1 | No | 1.0.0 | 1.1.0 |
| 2.2.2 | 12.22.2011 | 1.0 | No | Yes | No | SHA1 | No | No | No | 1.0.0 | -- |
| 2.2.1 | 07.01.2011 | 1.0 | No | Yes | No | SHA1 | No | No | No | 1.0.0 | -- |
| 2.2.1 | 04.26.2011 | 1.0 | No | Yes | No | SHA1 | No | No | No | 1.0.0 | -- |
| 2.1.0 | 12.11.2009 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.76 | -- |
| 2.0.9 | 10.01.2006 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.8 | 09.12.2006 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.7 | 04.12.2006 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.6 | 04.05.2006 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.5 | 11.02.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.4 | 11.01.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.3 | 09.25.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.2 | 08.25.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.1 | 08.16.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 2.0.0 | 04.17.2005 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.6.0 | 05.09.2004 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.5.0 | 11.20.2003 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.4.3 | 08.04.2003 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.4.2 | 07.15.2003 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.4.1 | 05.15.2003 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.4.0 | 05.07.2003 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.3.2 | 10.23.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.3.1 | 07.10.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.3.0 | 07.10.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.2.1 | 06.12.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.2.0 | 05.22.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.1.1 | 04.23.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.1.0 | 04.10.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 1.0 | 03.23.2002 | 1.0 | No | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 0.91 | 12.26.2001 | No | -- | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
| 0.90 | 05.13.2001 | No | -- | Yes | No | SHA1 | No | No | No | 0.9.6 | -- |
Scroll down for Release Notes.
General Recommendations
TLS 1.3 support requires OpenVPN 2.4.7 or higher.
OpenVPN versions below 2.3.3 should be considered insecure and avoided.
Cipher Suites and TLS/SSL Libraries
OpenVPN is compatible with ONLY two (2) TLS/SSL cipher libraries: OpenSSL (default) and mbedTLS (formerly known as PolarSSL). Do not attempt to incorporate any other TLS/SSL library as they are incompatible.
SSL Library Recommendation
Stick with OpenSSL (versus mbedTLS). Although its numbering system is very confusing, a 2017 security audit by QuarkLabs security audit found OpenSSL to have more choices in robust cryptographic cipers, increasing the likelihood of matchmaking a strong encryption method between client and server during connection negotiation.7
Known Vulnerabilities and Risks
Specific, known risks that present vulnerabilities under specific circumstances (not bugs).
Pre-2.6 [PLANNED] Branch Versions May Indirectly Force Insecure Cipher
Problem: Although deprecated in the 2.4 branch, prior to the release of the 2.6 [PLANNED] branch, various insecure cipher algorithms are still present and under various circumstances and combinations of OpenVPN client, server, and SSL cyrpto libraries may force the peer to downgrade to an insecure cipher algorithm. Branch 2.6 seeks to eliminate this possibility.
Recommended Solution: Use OpenVPN 2.4.x client or server and implement a strategy of forcing a secure cipher algorithm such as AES. Note this will cause the connection to fail if the peer is incapable of complying.
Pre-2.4 Branch Versions Default to Insecure Cipher
Problem: Pre-2.4 OpenVPN versions default to BF-CBC (BlowFish in Cipher Block Chaining mode), which is insecure.8
Recommended Solution: 2.4+ clients and servers should force a minimum cipher (a feature that became possible as of v2.4.0). Older versions should be upgraded to 2.4.0 or higher.
- OpenVPN 2.4 and newer support cipher negotiation.
- When both peers (client and server) support cipher negotiation, OpenVPN will default to using AES-GCM.
- Recommend setup 2.4+ clients and servers to force a minimum cipher to prevent a pre-2.4 peer from forcing a downgrade to BlowFish (pre-2.4 default cipher), which is insecure.7
2.4.x and pre-2.4 Failed Peer Negotiations
Problem: A 2.4.x+ and a pre-2.4 peer fail to connect because they cannot agree on connection protocols.
Background: 2.4.x and later clients and servers have the ability to restrict connections to peers that will accept a pre-determined set of ciphers. If the client and server cannot agree (i.e. they don't share any of the required ciphers), the connection will fail. Version 2.3.3 and higher versions are capable of TLS negotiation, TLS 1.2 (and 1.1, 1.0), and restricting connections to a minimum TLS version. These circumstances create a variety of possible combinations that will cause a connection to fail if one peer enforces a standard when the other peer disagrees or cannot meet the standard. Either the client and/or server may restrict connections during the TLS negotiation process such as refusing to negotiate (forced TLS level) and/or it could have lower TLS levels disabled. For example, if a 2.4.7 server requires a TLS 1.2 connection with cipher suite of AES256-SHA512, and the client is 2.3.10, the connection will fail because altough the client can do TLS 1.2, it is incapable of meeting the cipher suite requirement.
Recommended Solution: Ensure both client and server are using a 2.4.x (or higher) branch of OpenVPN. If restrictions are desired, set a minimum TLS and/or minimum cipher suite, but allow negotiation. This will eliminate most potential issues of this type.
Release Notes
Notable changes in various versions of OpenVPN, relevant to security. These lists are not comprehensive. See official changelogs (see References section) for full disclosure on version differences.
2.6 Branch [PLANNED RELEASE]
Support for BF-CBC, DES, CAST5, IDEA and RC2 ciphers are planned for removal in OVPN 2.6.9
2.4 Branch
ECDHE/ECDSA key exchange method is permitted.10 Authenticated Encryption with Associated Data (AEAD) cipher support added (e.g. AES-GCM). AEAD are ciphers that provide both confidentiality (encryption) and authentication at the same time. Non-AEAD ciphers provide confidentiality (encryption) only.
Ciphers with <=128 bits were deprecated in 2.4.0. Complete removal is planned for 2.6.
Added native option to build OpenVPN with mbedTLS (PolarSSL) instead of OpenSSL at installer runtime.11 This differs from the 2.3 branch behavior in that OpenSSL is not installed at all.
Acceptable cipher algorithms in the 2.4 branch are:9
- AES (256-bit)
- CAMELLIA
- SEED
Deprecated cipher algorithms are:
- BlowFish
- CAST5
- DES
- 3DES (Triple DES)
- DESX
- IDEA
- RC2
Other changes:
- Removed 128-bit blowfish key override for PolarSSL (now redundant per cipher update noted above).
- Acceptable cipher list may be limited by client or server (note this will cause connection rejection if they can't agree).12
- When cipher negotiation for data channel encryption (NCP) is allowed, both client and server side automatically upgrade to AES-256-GCM.
- mbedTLS (PolarSSL): Require mbedTLS (PolarSSL) version >= 1.3.8 (OVPN 2.4.0 alpha2).
- OpenSSL: Minimum OpenSSL version set to 0.9.8.
- OpenSSL: Made certificate expiry warning patch work on OpenSSL 1.0.1 and earlier.
2.4.8
Reinstated support for LibreSSL on OpenBSD 6.x (an operating system). There is some confusion regarding LibreSSL support in 2.4.8. It is only supported for OpenBSD 6, and only then because LibreSSL is built-in to OpenBSD 6. When OpenBSD changes the LibreSSL API (which happens occasionally), OpenVPN must be changed (hard-coded) for it to work on OpenBSD again. This is obviously an inefficient cycle, but at least OpenVPN makes the effort to support OpenBSD.
2.4.7
TLS 1.3 (client and server must both be version 2.4.7 or higher).
2.4.5
SHA-512 capability added to TLS 1.2 support.
2.4.4
Removed OpenSSL pre-1.1 function from OpenSSL compatibility interface.
2.3 Branch
- Defaults to BF-CBC (BlowFish) in Cipher Block Chaining (CBC) mode, which is insecure7
- Crypto algorithms depend on the back end in use (OpenSSL or mbedTLS).
- OpenSSL has stronger cryptos and more choices, though either is capable of AES 256 or 128-CBC-SHA.
Note that as of 2.3.0, mbedTLS (previously named PolarSSL) may be used instead of OpenSSL. Post-install, OpenVPN may be configured to use the PolarSSL cyryptographic library instead of OpenSSL. If OpenVPN is compiled via source code, it may be built directly with PolarSSL (mbedTLS) support and force the use of the PolarSSL library instead of OpenSSL. However, in either case OpenSSL is still installed. Also be advised the PolarSSL variant of OpenVPN does not support the same feature set as the default (OpenSSL) version.13
2.3.3
- TLS 1.1, 1.2 support14
- Added TLS cipher negotiation
- Minimum TLS version forcing (optional)
- Stronger RSA cipher choices added:
- AES-256-GCM-SHA384
- AES-256-CBC-SHA256
- AES-128-GCM-SHA256
- AES-128-CBC-SHA256
Pre-2.3.3 Releases
Pre-2.3.3 clients and servers can only connect to peers via TLS 1.0, SSLv3 (deprecated), or SSLv2 (deprecated). If stronger security is desired (such as TLS 1.2), you must upgrade to OpenVPN 2.3.3 at a minimum.
Available TLS v1.0 ciphers:
- GOOD:
- AES-256/SHA1: TLS-DHE-RSA-WITH-AES-256-CBC-SHA
- AES-128/SHA1: TLS-DHE-RSA-WITH-AES-128-CBC-SHA
- CAMELLIA-256/SHA1: TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA
- CAMELLIA-128/SHA1: TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
- SEED/SHA1: TLS-DHE-RSA-WITH-SEED-CBC-SHA
- BAD:
- 3DES/SHA1: TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA
- DES/SHA1: TLS-DHE-RSA-WITH-DES-CBC-SHA
2.3.2
AES256/SHA1 is the only available cipher compatible with the OpenVPN 2.4 branch.
2.3.1
HMAC encryption (slower than RSA) - 2.3, 2.3.1 / openssl before 1.1.0
2.3.0
- Uses HMAC encryption (slower than RSA).
- First version allowing mbedTLS (PolarSSL); versions below 2.3.0 must use OpenSSL.
- Only TLS 1.0 RSA ciphers are available:
- AES-256/SHA-1
- AES-128/SHA-1
- CAMELLIA-256/SHA-1
- CAMELLIA-128/SHA-1
- SEED/SHA-1
2.1 Branch
Any hash may be used for SHA1 crypto.
Pre-2.1 Branches
SHA1 crypto hash is hard-coded.
1.2 Branch
1.2.0 2048-bit RSA keys; config file added; daemon statistics monitoring; flexible device naming
0.90 Branch
0.90 initial release; IP tunnel over UDP; Blowfish cipher; SHA1 HMAC signature
References
2.4 branch changelog. https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24
fossies.org (some branch code deltas) https://fossies.org/diffs/openvpn/2.4.3_vs_2.4.4/README.polarssl-diff.html
LibreSSL not supported by OpenVPN. https://openvpn.net/download/openvpn-2-4-7-released-on-2019-02-21/
mbedTLS (formerly PolarSSL) downloads. https://tls.mbed.org/download-archive
OpenVPN 2.3.10 changelog. https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.10
OpenVPN 2.4.5 openssl 1.1.0 client not able to verify to openssl 1.0.1e-fips server. 2018. https://community.openvpn.net/openvpn/ticket/1050
Footnotes
1 TLS/SSL level negotiation between client and server. Disabled by default, but can be forced.
2 Minimum required version (higher versions may also be used unless otherwise noted)
3 Experimental
4 Compatible with AES-GCM cipher only [Reference: Cipher suite: TLS 1.3]
5 Requires mbedTLS version 2.0.0 or higher if building from source code and forcing installation of mbedTLS instead of OpenSSL. [Reference: OpenVPN Readme]
6 Windows version requires OpenSSL 0.9.8l or higher
7 OpenVPN 2.4.0 Security Assessment. 10 May 2017. Quarkslab. p. 20. Link: OpenVPN Security Audit File
8 See OpenVPN and SWEET32 and/or Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN.
9 Deprecated Options in OpenVPN. https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
10 Use of ECDHE/ECDSA key exchange requires both client and server OVPN version 2.4.0 or higher
11 Source: Using-mbedtls. December 2017. OpenVPN Community Wiki. https://community.openvpn.net/openvpn/wiki/Using-mbedtls
12 See Known Vulnerabilities and High Risks: 2.4.x and pre-2.4 Failed Peer Negotiations
13 Source: OpenVPN Community Wiki. December 2017. https://community.openvpn.net/openvpn/wiki/UsingPolarSSL
14 OpenVPN 2.3.3 or higher from both peers (client and server) is required for TLS v1.2