tls-crypt-v2 for openvpn server?

[Jaime Alvarez]

I don't see the option to add a tls-crypt-v2 key to the openvpn server. Is this just a GUI limitation or the OpenVPN version in AsusWRT Merlin does not allow it?

I'm not even sure if this is recommended or not, just playing around with hardening my setup.

 

[RMerlin]

I don't see the option to add a tls-crypt-v2 key to the openvpn server. Is this just a GUI limitation or the OpenVPN version in AsusWRT Merlin does not allow it?

I'm not even sure if this is recommended or not, just playing around with hardening my setup.

It's been a while since I implemented it, but I think the key needs to go in the Static Key field.

EDIT: Based on the Changelog, I think I only implemented tls-crypt-v2 support for clients, not for servers.

 

[Jaime Alvarez]

Thank you. This explains it then.

I did try putting it in the Static Key field and I got the following error (in the system log) : "Insufficient key material or header text not found in file 'static.key' (0/128/256 bytes found/min/max)"

 

[RMerlin]

Thank you. This explains it then.

I did try putting it in the Static Key field and I got the following error (in the system log) : "Insufficient key material or header text not found in file 'static.key' (0/128/256 bytes found/min/max)"

If you absolutely want to use tls-crypt-v2, you might be able to do so by manually configuring things in the Custom field, and storing the key in a file stored in /jffs/openvpn/ .

I think at the time I decided not to implement it because it was involving a lot of work due to the need to generate both the public and private keys.