Update OpenVPN config

openvpn-config/client.conf

@@ -31,13 +31,28 @@ tls-client
 # This way people with proper client certificates are unable to impersonate the server
 remote-cert-tls server
 
+### START BLOCK CRYPTOGRAPHY
 # Specific settings regarding TLS, chiphers and hash algorithms
 # DO NOT CHANGE THIS unless you receive explicit instructions to do so
+# These settings need to be identical in client and server configuration!
+
+# Protect data channel with this cipher
 cipher AES-256-GCM
+
+# Authenticate packets in data and control channel using HMAC with this
+# message digest algorithm
 auth SHA256
+
+# Use this specific cipher to secure the control channel
 tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
+
+# Only allow TLS version 1.2 and higher
 tls-version-min "1.2"
 
+# Use this elliptic curve for ECDHE within chosen tls-cipher
+ecdh-curve brainpoolP512r1
+### END BLOCK CRYPTOGRAPHY
+
 # Reduce connection timeout so connection problems are visible sooner
 connect-timeout 20