Re: [Openvpn-devel] [PATCH v3 19/21] Add insecure tls-cert-profile options

2021-10-27 Thread Max Fillinger
On 19/10/2021 20:31, Arne Schwabe wrote: The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add insecure as option to tls-cert-profile to allow sett

[Openvpn-devel] [PATCH v3 19/21] Add insecure tls-cert-profile options

2021-10-19 Thread Arne Schwabe
The recent deprecation of SHA1 certificates in OpenSSL 3.0 makes it necessary to reallow them in certain deployments. Currently this works by using the hack of using tls-cipher "DEFAULT:@SECLEVEL=0". Add insecure as option to tls-cert-profile to allow setting a seclevel of 0. Signed-off-by: Arne S