Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-05 Thread Samuli Seppänen
On 04/04/2017 10:48, Steffan Karger wrote: > Hi, > > On 3 April 2017 at 23:14, Selva Nair wrote: >> >> >> On Mon, Apr 3, 2017 at 4:43 PM, David Sommerseth >> wrote: >>> >>> On 03/04/17 16:12, Jan Just Keijser wrote: Hi Samuli, On 03/04/17 15:53, Samuli Seppänen wrote: > On 02/

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-04 Thread Selva Nair
Hi, On Tue, Apr 4, 2017 at 3:48 AM, Steffan Karger wrote: > From the openssl man page: > > "Beware that with such DSA-style DH parameters, a fresh DH key should > be created for each use to avoid small-subgroup attacks that may be > possible otherwise." > > This means that if for some reason a n

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-04 Thread Jan Just Keijser
Hi David, On 03/04/17 22:43, David Sommerseth wrote: On 03/04/17 16:12, Jan Just Keijser wrote: On 03/04/17 15:53, Samuli Seppänen wrote: On 02/04/2017 10:57, Steffan Karger wrote: Hi, On 31-03-17 22:34, David Sommerseth wrote: On 31/03/17 10:56, Илья Шипицин wrote: 2017-03-31 13:26 GMT+0

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-04 Thread Steffan Karger
Hi, On 3 April 2017 at 23:14, Selva Nair wrote: > > > On Mon, Apr 3, 2017 at 4:43 PM, David Sommerseth > wrote: >> >> On 03/04/17 16:12, Jan Just Keijser wrote: >> > Hi Samuli, >> > >> > On 03/04/17 15:53, Samuli Seppänen wrote: >> >> On 02/04/2017 10:57, Steffan Karger wrote: > > > snip.. > >>

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-03 Thread Selva Nair
On Mon, Apr 3, 2017 at 4:43 PM, David Sommerseth < open...@sf.lists.topphemmelig.net> wrote: > On 03/04/17 16:12, Jan Just Keijser wrote: > > Hi Samuli, > > > > On 03/04/17 15:53, Samuli Seppänen wrote: > >> On 02/04/2017 10:57, Steffan Karger wrote: > snip.. > >>> DSA is _not_ a preferred choi

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-03 Thread David Sommerseth
On 03/04/17 16:12, Jan Just Keijser wrote: > Hi Samuli, > > On 03/04/17 15:53, Samuli Seppänen wrote: >> On 02/04/2017 10:57, Steffan Karger wrote: >>> Hi, >>> >>> On 31-03-17 22:34, David Sommerseth wrote: On 31/03/17 10:56, Илья Шипицин wrote: > 2017-03-31 13:26 GMT+05:00 Samuli Seppäne

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-03 Thread debbie10t
On 03/04/17 15:12, Jan Just Keijser wrote: > Hi Samuli, > > On 03/04/17 15:53, Samuli Seppänen wrote: >> >> I tested these changes on Debian 8 which has OpenSSL-1.0.1. Key size was >> set to 4096-bits and signature algorithm to SHA256WithRSAEncryption. >> >> The only real issue was DH parameter

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-03 Thread Jan Just Keijser
Hi Samuli, On 03/04/17 15:53, Samuli Seppänen wrote: > On 02/04/2017 10:57, Steffan Karger wrote: >> Hi, >> >> On 31-03-17 22:34, David Sommerseth wrote: >>> On 31/03/17 10:56, Илья Шипицин wrote: 2017-03-31 13:26 GMT+05:00 Samuli Seppänen >>> >: Hi,

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-03 Thread Samuli Seppänen
On 02/04/2017 10:57, Steffan Karger wrote: > Hi, > > On 31-03-17 22:34, David Sommerseth wrote: >> On 31/03/17 10:56, Илья Шипицин wrote: >>> 2017-03-31 13:26 GMT+05:00 Samuli Seppänen >> >: >>> >>> Hi, >>> >>> We still bundle EasyRSA 2 with our Windows installer

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-04-02 Thread Steffan Karger
Hi, On 31-03-17 22:34, David Sommerseth wrote: > On 31/03/17 10:56, Илья Шипицин wrote: >> 2017-03-31 13:26 GMT+05:00 Samuli Seppänen > >: >> >> Hi, >> >> We still bundle EasyRSA 2 with our Windows installers and it is >> prominently advertised on our widely

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-03-31 Thread David Sommerseth
On 31/03/17 10:56, Илья Шипицин wrote: > > > 2017-03-31 13:26 GMT+05:00 Samuli Seppänen >: > > Hi, > > We still bundle EasyRSA 2 with our Windows installers and it is > prominently advertised on our widely linked to HOWTO: > >

Re: [Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-03-31 Thread Илья Шипицин
2017-03-31 13:26 GMT+05:00 Samuli Seppänen : > Hi, > > We still bundle EasyRSA 2 with our Windows installers and it is > prominently advertised on our widely linked to HOWTO: > > > > As such, EasyRSA 2 is used by many/most OpenVP

[Openvpn-devel] Upgrading EasyRSA 2's defaults

2017-03-31 Thread Samuli Seppänen
Hi, We still bundle EasyRSA 2 with our Windows installers and it is prominently advertised on our widely linked to HOWTO: As such, EasyRSA 2 is used by many/most OpenVPN server admins. However, the default values for EasyRSA 2