CRA Requirements for VPN Software (EN 304 620)

🔒 VPN Software Under the CRA (EN 304 620)

VPN software is classified as Important Products Class I. Given the sensitive nature of VPN traffic, the CRA imposes specific security requirements.

Key Requirements

Encryption Standards

• Minimum TLS 1.3 for control plane
• AES-256-GCM or ChaCha20-Poly1305 for data plane
• Forward secrecy mandatory (ECDHE key exchange)
• No fallback to weak ciphers

Authentication

• Certificate-based authentication support
• Multi-factor authentication capability
• No default credentials
• Secure credential storage

Data Protection

• No logging of traffic content by default
• Minimal metadata collection
• DNS leak prevention — force DNS through VPN tunnel
• Kill switch — block traffic if VPN disconnects

Update Mechanism

• Signed updates with cryptographic verification
• Auto-update capability
• Rollback protection

For Enterprise VPN Deployments

If your organization deploys VPN software:

• The VPN vendor is the manufacturer (CRA applies to them)
• You should verify your vendor’s CRA compliance roadmap
• Request SBOMs and vulnerability handling documentation
• Include CRA compliance in procurement criteria

SBOM Requirements

VPN software SBOMs must include:

• Cryptographic libraries (OpenSSL, BoringSSL, WireGuard kernel module)
• Network stack components
• Authentication modules
• UI frameworks
• All transitive dependencies

Developing or deploying VPN software in the EU? I help organizations prepare for EN 304 620 compliance. Get in touch.