← Knowledge base

OpenVPN

OpenVPN uses a TLS control channel and a separate data channel. A web TLS check cannot speak the VPN protocol or establish how the tunnel negotiated keys.

Evidence to collect

  1. Record both peers’ OpenVPN and crypto-library versions.
  2. Review supported tls-groups configuration for the installed versions and collect control-channel negotiation evidence.
  3. Assess data-channel encryption and authentication separately. A tls-crypt key is not proof of a negotiated post-quantum KEM.
  4. Use supported vendor diagnostics; do not publish keys, full configurations, or private connection logs.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

openvpn --version

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.