library versions: OpenSSL 1.1.1b, LZO 2.10 openvpn --show-digests MD5 128 bit digest size MD5 128 bit digest size SHA1 160 bit digest size SHA1 160 bit digest size MDC2 128 bit digest size MDC2 128 bit digest size MD5-SHA1 288 bit digest size SHA1 160 bit digest size RIPEMD160 160 bit digest size RIPEMD160 160 bit digest size MD4 128 bit digest size MD4 128 bit digest size SHA256 256 bit digest size SHA384 384 bit digest size SHA512 512 bit digest size SHA224 224 bit digest size SHA256 256 bit digest size SHA384 384 bit digest size SHA512 512 bit digest size SHA224 224 bit digest size whirlpool 512 bit digest size BLAKE2b512 512 bit digest size BLAKE2s256 256 bit digest size SHA512-224 224 bit digest size SHA512-256 256 bit digest size SHA3-224 224 bit digest size SHA3-256 256 bit digest size SHA3-384 384 bit digest size SHA3-512 512 bit digest size SHAKE128 128 bit digest size SHAKE256 256 bit digest size SHA3-224 224 bit digest size SHA3-256 256 bit digest size SHA3-384 384 bit digest size SHA3-512 512 bit digest size SM3 256 bit digest size SM3 256 bit digest size SHA512-224 224 bit digest size SHA512-256 256 bit digest size openvpn --show-ciphers AES-128-CBC (128 bit key, 128 bit block) AES-128-CFB (128 bit key, 128 bit block, TLS client/server mode only) AES-128-CFB1 (128 bit key, 128 bit block, TLS client/server mode only) AES-128-CFB8 (128 bit key, 128 bit block, TLS client/server mode only) AES-128-GCM (128 bit key, 128 bit block, TLS client/server mode only) AES-128-OFB (128 bit key, 128 bit block, TLS client/server mode only) AES-192-CBC (192 bit key, 128 bit block) AES-192-CFB (192 bit key, 128 bit block, TLS client/server mode only) AES-192-CFB1 (192 bit key, 128 bit block, TLS client/server mode only) AES-192-CFB8 (192 bit key, 128 bit block, TLS client/server mode only) AES-192-GCM (192 bit key, 128 bit block, TLS client/server mode only) AES-192-OFB (192 bit key, 128 bit block, TLS client/server mode only) AES-256-CBC (256 bit key, 128 bit block) AES-256-CFB (256 bit key, 128 bit block, TLS client/server mode only) AES-256-CFB1 (256 bit key, 128 bit block, TLS client/server mode only) AES-256-CFB8 (256 bit key, 128 bit block, TLS client/server mode only) AES-256-GCM (256 bit key, 128 bit block, TLS client/server mode only) AES-256-OFB (256 bit key, 128 bit block, TLS client/server mode only) ARIA-128-CBC (128 bit key, 128 bit block) ARIA-128-CFB (128 bit key, 128 bit block, TLS client/server mode only) ARIA-128-CFB1 (128 bit key, 128 bit block, TLS client/server mode only) ARIA-128-CFB8 (128 bit key, 128 bit block, TLS client/server mode only) ARIA-128-OFB (128 bit key, 128 bit block, TLS client/server mode only) ARIA-192-CBC (192 bit key, 128 bit block) ARIA-192-CFB (192 bit key, 128 bit block, TLS client/server mode only) ARIA-192-CFB1 (192 bit key, 128 bit block, TLS client/server mode only) ARIA-192-CFB8 (192 bit key, 128 bit block, TLS client/server mode only) ARIA-192-OFB (192 bit key, 128 bit block, TLS client/server mode only) ARIA-256-CBC (256 bit key, 128 bit block) ARIA-256-CFB (256 bit key, 128 bit block, TLS client/server mode only) ARIA-256-CFB1 (256 bit key, 128 bit block, TLS client/server mode only) ARIA-256-CFB8 (256 bit key, 128 bit block, TLS client/server mode only) ARIA-256-OFB (256 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-128-CBC (128 bit key, 128 bit block) CAMELLIA-128-CFB (128 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-128-CFB1 (128 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-128-CFB8 (128 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-128-OFB (128 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-192-CBC (192 bit key, 128 bit block) CAMELLIA-192-CFB (192 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-192-CFB1 (192 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-192-CFB8 (192 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-192-OFB (192 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-256-CBC (256 bit key, 128 bit block) CAMELLIA-256-CFB (256 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-256-CFB1 (256 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-256-CFB8 (256 bit key, 128 bit block, TLS client/server mode only) CAMELLIA-256-OFB (256 bit key, 128 bit block, TLS client/server mode only) CHACHA20-POLY1305 (256 bit key, stream cipher, TLS client/server mode only) SEED-CBC (128 bit key, 128 bit block) SEED-CFB (128 bit key, 128 bit block, TLS client/server mode only) SEED-OFB (128 bit key, 128 bit block, TLS client/server mode only) SM4-CBC (128 bit key, 128 bit block) SM4-CFB (128 bit key, 128 bit block, TLS client/server mode only) SM4-OFB (128 bit key, 128 bit block, TLS client/server mode only) The following ciphers have a block size of less than 128 bits, and are therefore deprecated. Do not use unless you have to. BF-CBC (128 bit key by default, 64 bit block) BF-CFB (128 bit key by default, 64 bit block, TLS client/server mode only) BF-OFB (128 bit key by default, 64 bit block, TLS client/server mode only) CAST5-CBC (128 bit key by default, 64 bit block) CAST5-CFB (128 bit key by default, 64 bit block, TLS client/server mode only) CAST5-OFB (128 bit key by default, 64 bit block, TLS client/server mode only) DES-CBC (64 bit key, 64 bit block) DES-CFB (64 bit key, 64 bit block, TLS client/server mode only) DES-CFB1 (64 bit key, 64 bit block, TLS client/server mode only) DES-CFB8 (64 bit key, 64 bit block, TLS client/server mode only) DES-EDE-CBC (128 bit key, 64 bit block) DES-EDE-CFB (128 bit key, 64 bit block, TLS client/server mode only) DES-EDE-OFB (128 bit key, 64 bit block, TLS client/server mode only) DES-EDE3-CBC (192 bit key, 64 bit block) DES-EDE3-CFB (192 bit key, 64 bit block, TLS client/server mode only) DES-EDE3-CFB1 (192 bit key, 64 bit block, TLS client/server mode only) DES-EDE3-CFB8 (192 bit key, 64 bit block, TLS client/server mode only) DES-EDE3-OFB (192 bit key, 64 bit block, TLS client/server mode only) DES-OFB (64 bit key, 64 bit block, TLS client/server mode only) DESX-CBC (192 bit key, 64 bit block) IDEA-CBC (128 bit key, 64 bit block) IDEA-CFB (128 bit key, 64 bit block, TLS client/server mode only) IDEA-OFB (128 bit key, 64 bit block, TLS client/server mode only) RC2-40-CBC (40 bit key by default, 64 bit block) RC2-64-CBC (64 bit key by default, 64 bit block) RC2-CBC (128 bit key by default, 64 bit block) RC2-CFB (128 bit key by default, 64 bit block, TLS client/server mode only) RC2-OFB (128 bit key by default, 64 bit block, TLS client/server mode only openvpn --show-engines Sorry, OpenSSL hardware crypto engine functionality is not available. openvpn --show-tls Available TLS Ciphers, listed in order of preference: For TLS 1.3 and newer (--tls-ciphersuites): TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 For TLS 1.2 and older (--tls-cipher): TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA TLS-DHE-RSA-WITH-AES-256-CBC-SHA TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA TLS-DHE-RSA-WITH-AES-128-CBC-SHA Be aware that that whether a cipher suite in this list can actually work depends on the specific setup of both peers. See the man page entries of --tls-cipher and --show-tls for more details.