OpenVPN: TLS-Based VPN Architecture

OpenVPN uses two separate channels: the control channel and the data channel. The control channel handles authentication, session establishment, and configuration exchange using TLS. The data channel carries actual VPN traffic encrypted with a symmetric cipher negotiated through the control channel. This separation allows OpenVPN to leverage the full TLS ecosystem for key management.

The OpenVPN control channel runs a full TLS session. Both sides authenticate using X.509 certificates signed by a shared CA. TLS provides the key exchange, certificate validation, and negotiation of data channel cipher parameters. Because TLS supports ECDHE, the control channel provides perfect forward secrecy: data channel keys cannot be recovered from a captured session even with the CA key.