Cipher Alogrithm 'AES-256-GCM' Not Found (OpenVPN Error)

Question

I was trying to connect to a .ovpn file using OpenVPN but when I try to connect it with this command:

sudo openvpn --config downloaded-client-config.ovpn

It failed with the following output:

Wed Jun 17 23:53:03 2020 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  9 2019
Wed Jun 17 23:53:03 2020 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Wed Jun 17 23:53:03 2020 Cipher algorithm 'AES-256-GCM' not found (OpenSSL)
Wed Jun 17 23:53:03 2020 Exiting due to fatal error

My OpenSSL version: OpenSSL 1.1.0h 27 Mar 2018

OpenVPN version: OpenVPN 2.3.10

Ubuntu Version: 16.04

Also, I ran this command as well to see the list of ciphers I have: openvpn --show-ciphers

and AES-256-GCM was not present in that in that list. How can I add it manually if it's possible?

PS: I am kind of a layman with respect to OpenVPN

your ubuntu version is rather old. Condider upgrading to something more recent. It could be openvpn is still using openssl 0.9.8 — arved, Jun 18 '20 at 12:22

score 3 · Accepted Answer · answered Jun 30 '20 at 12:50

3

This is an issue with the OpenVPN version. The AES-256-GCM cipher was added in version 2.4.

You can follow these steps to install OpenVPN 2.4 on Ubuntu 16.04 at which point the cipher should properly work. The suggestion in the comments to upgrade your OS entirely would also work, but is certainly not necessary!

answered Jun 30 '20 at 12:50

Cory

22,772
19
94
91

I'd like to point out that these suggestions can be deciphered in more detail by reading this document: https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos and scrolling to "Debian / Ubuntu: Using OpenVPN apt repositories" - someone using a version other than 16.04 may miss the fact xenial should be replaced with the appropriate argument. – Sandy Simonton Dec 12 '20 at 01:40

score 1 · Answer 2 · answered Jul 22 '21 at 08:43

I had a similar issue trying to connect a 2.3.2 client to a 2.4.4 server. I referred to this cipher negotiation reference and updated both server and client config to use cipher AES-256-CBC

When the 2.4 server is set to AES-256-CBC, the clients (also set to AES-256-CBC) negotiate the following ciphers:

2.5 - AES-256-GCM
2.4 - AES-256-GCM
2.3 - AES-256-CBC
2.2 - AES-256-CBC

Cipher Alogrithm 'AES-256-GCM' Not Found (OpenVPN Error)

2 Answers2