<![CDATA[2.5.0 OpenVPN no AES-NI]]>I see on the dashboard Hardware Crypto is enabled and active but i can't choose it in the OpenVPN configuration.

Version: built on Sat Aug 08 01:03:06 EDT 2020

I thought this bug was solved or not?
Bug 9646

If this is not fixed is there any timeframe this will be fixed.

Yes i know i'm running a dev version but i think this bug is grave.

 openssl engine -t -c -pre DUMP_INFO
(dynamic) Dynamic engine loading support
[Failure]: DUMP_INFO
34370871296:error:260AC089:engine routines:int_ctrl_helper:invalid cmd name:/build/ce-crossbuild-master/sources/FreeBSD-src/crypto/openssl/crypto/engine/eng_ctrl.c:87:
34370871296:error:260AB089:engine routines:ENGINE_ctrl_cmd_string:invalid cmd name:/build/ce-crossbuild-master/sources/FreeBSD-src/crypto/openssl/crypto/engine/eng_ctrl.c:255:
     [ unavailable ]

Ok looks like this is not working.
CPU has AES-NI features und it was working in the past on these servers (Dell R210 II )

sysctl -a | egrep -i 'hw.machine|hw.model|hw.ncpu'
hw.machine: amd64
hw.model: Intel(R) Xeon(R) CPU E31220 @ 3.10GHz
hw.ncpu: 4
hw.machine_arch: amd64
dmesg -a | grep Features
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x1fbae3ff<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX>


 openssl engine -c -t
(dynamic) Dynamic engine loading support
     [ unavailable ]
]]>https://forum.netgate.com/topic/155913/2-5-0-openvpn-no-aes-niRSS for NodeTue, 21 Jul 2026 10:52:41 GMTSat, 08 Aug 2020 21:04:29 GMT60<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Fri, 14 Aug 2020 13:26:32 GMT]]>Those are two completely different sets of crypto controls. One for the operating system in general, and one specifically for OpenVPN. There are many more uses for crypto on pfSense than OpenVPN.

AES-NI never shows in OpenVPN because it isn't a relevant option. It is not considered a crypto "engine" to OpenVPN or OpenSSL, because it uses it automatically. Some devices have to be selected manually.

]]>https://forum.netgate.com/post/929432https://forum.netgate.com/post/929432Fri, 14 Aug 2020 13:26:32 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Thu, 13 Aug 2020 22:53:11 GMT]]>Thank you for the clarification.

But why is there the option if it will be NEVER shown in the OpenVPN configuration?

]]>https://forum.netgate.com/post/929348https://forum.netgate.com/post/929348Thu, 13 Aug 2020 22:53:11 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Thu, 13 Aug 2020 13:56:15 GMT]]>AES-NI will never show on the OpenVPN page. OpenVPN/OpenSSL will detect and use AES-NI automatically.

The only place you can pick AES-NI from a list is under System > Advanced on the Misc tab to tell the system whether or not to load the kernel module. Primarily that will affect IPsec, not OpenVPN.

]]>https://forum.netgate.com/post/929296https://forum.netgate.com/post/929296Thu, 13 Aug 2020 13:56:15 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Thu, 13 Aug 2020 12:04:50 GMT]]>In 2.4.* it is also not showing and, as far as I remember, never was (Hyper-V), so I hope it is working automagically.

]]>https://forum.netgate.com/post/929273https://forum.netgate.com/post/929273Thu, 13 Aug 2020 12:04:50 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Thu, 13 Aug 2020 11:45:31 GMT]]>OK so there is an patch for ssl but this patch is causing problems as i read.

OpenSSL was patched in 2018 but this bug exists in pfsense in 2020? Or is there another bug which is causing this?

]]>https://forum.netgate.com/post/929271https://forum.netgate.com/post/929271Thu, 13 Aug 2020 11:45:31 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Wed, 12 Aug 2020 14:06:34 GMT]]>I have reported this issue before.

2.png

]]>https://forum.netgate.com/post/929156https://forum.netgate.com/post/929156Wed, 12 Aug 2020 14:06:34 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 16:41:43 GMT]]>kldstat Id Refs Address Size Name 1 19 0xffffffff80200000 38d7128 kernel 2 2 0xffffffff83ad9000 a448 opensolaris.ko 3 1 0xffffffff83ae4000 3ba750 zfs.ko 4 1 0xffffffff8423d000 1000 cpuctl.ko 5 1 0xffffffff8423e000 8c90 aesni.ko 6 1 0xffffffff84247000 37e8 cryptodev.ko ]]>https://forum.netgate.com/post/928877https://forum.netgate.com/post/928877Mon, 10 Aug 2020 16:41:43 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 15:39:43 GMT]]>Is aesni loaded in kldstat output?

]]>https://forum.netgate.com/post/928870https://forum.netgate.com/post/928870Mon, 10 Aug 2020 15:39:43 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 15:35:07 GMT]]>Yes it is enabled in the BIOS as you see above the CPU does report the correct features

I only see the CPU features in the dmesg.boot.

]]>https://forum.netgate.com/post/928868https://forum.netgate.com/post/928868Mon, 10 Aug 2020 15:35:07 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 14:38:29 GMT]]>Any messages in the system log about aesni? Check /var/log/dmesg.boot specifically.

You should see a line like this:

Aug 10 10:37:45 pfSense kernel: aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS> on motherboard

Is it enabled in your BIOS?

]]>https://forum.netgate.com/post/928857https://forum.netgate.com/post/928857Mon, 10 Aug 2020 14:38:29 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 14:34:27 GMT]]>Yes i tried both - AES-NI and BSD Cyptodev

]]>https://forum.netgate.com/post/928855https://forum.netgate.com/post/928855Mon, 10 Aug 2020 14:34:27 GMT<![CDATA[Reply to 2.5.0 OpenVPN no AES-NI on Mon, 10 Aug 2020 14:16:20 GMT]]>Did you set AES-NI under System > Advanced, Misc. in the crypto module options?

]]>https://forum.netgate.com/post/928848https://forum.netgate.com/post/928848Mon, 10 Aug 2020 14:16:20 GMT