On Fri, Dec 16, 2016 at 11:02 AM, Jan Just Keijser <[email protected]>
wrote:
> > There is no way for a customer like me to get hold of my VPN provider's
> server and intermediate certificates to check if the cipher strength is at
> least 2048 bits, correct?
> >
> >
> the openvpn server actually sends this information to the client when it
> tries to connect, but it is quite hard to get at it. I don't have much
> time to investigate,but I'm curious what happens if the server has a
> 2048bit certificate signed by a 1024bit CA - that should pop up
> somewhere in the logs, but I simply don't know when & where.
The client config would include the ca certificate (and, I think, all
intermediate certs as well) either as inline or as a separate file. So one
could manually check the certificates. As for the server cert, you could
use
--tls-verify some-script.sh
--tls-export-cert directory
in the config. These options do work on clients though more commonly used
on servers. The script can then access each certificate at the path given
in peer_cert env variable and use /usr/bin/openssl to find key size etc...
See the man page for details about those options.
Selva
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
