The recommendation to use a 1024-bit RSA key worries me. In an era of passive, bulk surveillance, that seems too weak if you're not going to be using any additi

The recommendation to use a 1024-bit RSA key worries me. In an era of passive, bulk surveillance, that seems too weak if you're not going to be using any additional transport-layer security. The performance argument is only relevant for the establishment of the VPN connection and any periodic rekeying ­— it shouldn't have any impact on the tunnel's perf. It's a shame openvpn's easy-rsa doesn't provide a straightforward mechanism to generate ECDSA certificates, which would've removed any performance concerns. -- edit: easy-rsa does support ECDSA[1]: Support for generating an ECDSA certificate chain is available in EasyRSA (in spite of it's name) since EasyRSA 3.0. The parameters you're looking for are '--use-algo=ec' and '--curve=<curve_name>'. See the EasyRSA documentation for more details on generating ECDSA certificates. https://github.com/OpenVPN/openvpn/blob/master/README.ec https://github.com/OpenVPN/openvpn/blob/master/README.ec