Please consider upgrading to openvpn 2.4.0 when it gets released...

[SnakeByte]

OpenVPN version 2.4.0 will finally officially supports ECC certificates.

Source: https://github.com/OpenVPN/openvpn/blob/master/README.ec

ECC certs have smaller keys (nvram woes begone), and the crypto is less expensive than the RSA counterparts which should mean better performance on devices like ASUS routers.

 

[RMerlin]

Take a deep breath... It's not even released YET...

 

[Zirescu]

Certs are now stored on JFFS so NVRAM woes isn't an issue.

 

[SnakeByte]

Haha, hey, my title did say "when it gets released." I figured you're a busy guy (I'm still amazed you haven't burned out here in the forums alone), and just wanted bring what I considered helpful info to your table. It's hard to keep track of all the software releases and what they offer and I know that often times the updates don't bring anything worthy of upgrading.

I got bit in the butt recently with my QNAP when they decided to upgrade to the latest version of openssh. The latest version disables support for DSA keys by default. That got me to re-investigate what the current recommended statue of pki is and thus my interest in ecc.

 

[SnakeByte]

Certs are now stored on JFFS so NVRAM woes isn't an issue.

That reminds me... If I do a Administration -> Save Setting and factory reset my router, a restore will put those keys back in JFFS?

 

[john9527]

Haha, hey, my title did say "when it gets released."

The document you referenced was a roadmap document from April 2014
They are just working on 2.3.9, then there is a plan for a 2.4 alpha and RC builds before release. I'd guess 2.4.0 is 3-6 months away.

 

[Zirescu]

That reminds me... If I do a Administration -> Save Setting and factory reset my router, a restore will put those keys back in JFFS?

I can't say for sure, but I'm thinking that no it wouldn't work. I vaguely remember reading a thread that suggested a way to export it out of nvram and then over to jffs. It wasn't a big deal for me to import my client configs again. And I only have a few clients that I exported the new vpn server settings to. I'm not sure if John's nvram-save scripts handles moving the current settings out to JFFS (didn't see anything that mentioned it specifically in the changelog).