OCC warnings about cipher and auth mismatch are misleading

[Gert Döring]

In a setup where NCP is active, a client might warn in its logfile about cipher mismatch (if it has a different cipher configured than the server), but it is of no consequences because NCP will do the right thing anyway.

I think this needs to be fixed - possibly by announcing NCP status in the OCC messages, and "if I have NCP and the other side has NCP, ignore mismatches in cipher and auth".

Or maybe "if I am NCP *capable* and the server has NCP *enabled*" (because 2.4 with --ncp-disable talking to a 2.5 server will still get a proper cipher back).

[Gert Döring]

I just learned that 2.5 will no longer print cipher warnings anyway (never, unconditionally). At least, as of today.

So 2.4 remains...

[tct]

I am CC'ing myself but also want to add this link:
​https://community.openvpn.net/openvpn/wiki/CipherNegotiation

OpenVPN 2.4 vs 2.5 (and 2.2/2.3) do have some differences but the final outcome is as optimal as possible.

[Gert Döring]

So is there anything left to do for 2.4.11? Or close for good - issue is documented, fixed for 2.5, and search engines will find this thread?