From f7a1fdf0266cf3149764b3608384f5a5092ab526 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Thu, 1 Oct 2026 15:45:19 +0200 Subject: openvpn: T9386: AEAD fallback ciphers can't be used with shared-secret-key Note that "encryption data-ciphers-fallback" only takes CBC ciphers together with "shared-secret-key". --- docs/configuration/interfaces/openvpn.md | 3 +++ 1 file changed, 3 insertions(+) (limited to 'docs') diff --git a/docs/configuration/interfaces/openvpn.md b/docs/configuration/interfaces/openvpn.md index 2c31ea80..b2f7c584 100644 --- a/docs/configuration/interfaces/openvpn.md +++ b/docs/configuration/interfaces/openvpn.md @@ -110,6 +110,9 @@ supported**. This option ensures consistent encryption between two static peers without cipher negotiation capability. ::: + +With `shared-secret-key`, AEAD ciphers (`aes128gcm`, `aes192gcm`, `aes256gcm`, +`chacha20poly1305`) are rejected: only the CBC ciphers and `none` can be used. ``` -- cgit v1.2.3