openvpn: add mbedtls build option.

[travankor]

Default to it since openvpn is broken with libressl-3.1.X.

[travankor]

@jkoderu-git This should fix the issue with openvpn.

[mobinmob]

That is nice - mbedtls has LTS releases ;)

[jkoderu-git]

Thank you so much @travankor for your help!

[Johnnynator]

Did you check if this fixes the problematic servers? (only aware of ProtonVPN confis so far)

[ericonr]

Can we be sure this doesn't break other uses of OpenVPN as well?

[travankor]

mbedtls is officially supported by openvpn. This should be 100% interoperable with other openvpn instances. (Some trivia: This version of openvpn was sponsored by the Dutch government for their restricted communication channels.)

The features that don't work compared to the openssl build:

 * PKCS#12 file support
 * --capath support - Loading certificate authorities from a directory
 * Windows CryptoAPI support
 * X.509 alternative username fields (must be "CN")

This is why the mbedtls and pkcs12 options conflict since the build fails with both turned on.

---

Admittedly, I don't know the reason why libressl is causing problems and to what extent things are broken with openvpn. And yes, I tested protonovpn, which seems to work.

[travankor]

Can we be sure this doesn't break other uses of OpenVPN as well?

Can you suggest some to test? Keep in mind that I can't really test every use case (like the ones involving corporate networks).

So far, I think the main difference is that the mbedtls version is a little slower and less responsive than the openssl/libressl version.

[ericonr]

Can you suggest some to test?

I have no idea, because I don't use it myself. Just want to avoid a regression for OpenVPN users whose setup is working with the latest LibreSSL version.

[travankor]

The best solution is to use Openssl. The other options are either 1) mbedtls or 2) patch libressl and/or openvpn to work.

[Redcroft]

Hi,

This has broken pcks12 for me, is there anyway we can re-enable this option?

Thanks

[ericonr]

@Redcroft could you open a separate issue, please? That way it's easier to track. If you know how to build the package yourself, you can build it with the pcks11 build option.