Hacker News Reader

This has good information - http://docs.hardentheworld.org/Applications/OpenVPN/

I noticed DH params do get generated via easy-rsa (although not audited that code, so can't comment on how rigid it is, nor what keysize is being used so that could be defaulting to 1024 which isn't all that great nowadays)

View on HN

Looking that the easy-rsa 3 script that now comes bundled with OpenVPN, that value is set to 2048 bits:

set_var EASYRSA_KEY_SIZE 2048

# gen-dh backend: gen_dh() { verify_pki_init

local out_file="$EASYRSA_PKI/dh.pem" "$EASYRSA_OPENSSL" dhparam -out "$out_file" $EASYRSA_KEY_SIZE || \ die "Failed to build DH params" notice "\

https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/eas...

Reply on news.ycombinator.com