New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

openconnect to include RFC9266 `tls-exporter` (TLSv1.3) support #26108

Open

stormy1777 opened this issue Mar 6, 2025 · 0 comments

stormy1777 commented Mar 6, 2025

Using openconnect v9.12-r5 (openwrt 24.10) fails to connect to newer VPN headends that require this fix:

Use RFC9266 'tls-exporter' channel bindings for Cisco STRAP with TLSv1.3.

Connection immediately fails with 'HTTP/1.1 401 Unauthorized'
Please rebuild openconnect to support TLS1.3 fully..

Until then, as a workaround, adding this , falls back to TLSv1.2 and vpn connection is possible (until 1.2 is removed)

--gnutls-priority="NORMAL:-VERS-ALL:+VERS-TLS1.2:+RSA:+AES-128-CBC:+SHA1" it overcome 'HTTP/1.1 401 Unauthorized'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment