3 ms·
Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN. There is a bit more info in the "community" wiki [0]. It seems
by Wilya 13y ago
Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN.
There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself.
And, as noted in the community statement, the TLS-auth is a single global pre-shared key. It could leak a bit more easily than personal certificates.
[0] https://community.openvpn.net/openvpn/wiki/heartbleed https://community.openvpn.net/openvpn/wiki/heartbleed
- mrsaint 13y agoWell, TLS-auth should be used _on top_ of a PKI. It is a HMAC key that an attacker would need to know before he'd even be able to initiate a TLS handshake. Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.