With a firmware update at the beginning of this year, I don't understand how you keep DEPRECATED opcoines and UNSAFE settings.
Messages:
- (1) WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead
- (2) WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32.Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC)
- (3) WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
- (4) WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
The Deprecated are easy to solve: on the customer side, within the .OVPN we must add:
- remote-cert-tls (1)
- auth-nocache (4)
And here comes the problem, I might add on server side:
- cipher AES-256-CBC (2) (3)
But on the server side and if we want to keep your firmware, we can't do it ourselves and must wait for an update.
Can you update it yourselves? Can you fix these OpenVPN features?
It's a pity that these efforts are not made in security, with the times we are living and as someone wrote to you a year ago, even a SmartWatch has greater encryption strength.