diff --git a/net/openvpn/Makefile b/net/openvpn/Makefile
index a92b4ec148..0c3bf46761 100644
--- a/net/openvpn/Makefile
+++ b/net/openvpn/Makefile
@@ -9,14 +9,14 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openvpn
 
-PKG_VERSION:=2.6.19
+PKG_VERSION:=2.6.20
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
 	https://swupdate.openvpn.net/community/releases/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=13702526f687c18b2540c1a3f2e189187baaa65211edcf7ff6772fa69f0536cf
+PKG_HASH:=952ecee5b911a5353c0a6d40af62a7076c6dea1481ef204ce6d3f10481531315
 
 PKG_MAINTAINER:=
 
diff --git a/net/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch b/net/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
index 919e5400e5..d46da55ae7 100644
--- a/net/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
+++ b/net/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
@@ -1,11 +1,15 @@
 --- a/src/openvpn/ssl_mbedtls.c
 +++ b/src/openvpn/ssl_mbedtls.c
-@@ -1611,7 +1611,7 @@ const char *
+@@ -1610,11 +1610,7 @@ get_highest_preference_tls_cipher(char *
+ const char *
  get_ssl_library_version(void)
  {
-     static char mbedtls_version[30];
+-    static char mbedtls_version[30];
 -    unsigned int pv = mbedtls_version_get_number();
-+    unsigned int pv = MBEDTLS_VERSION_NUMBER;
-     snprintf(mbedtls_version, sizeof(mbedtls_version), "mbed TLS %d.%d.%d",
-              (pv>>24)&0xff, (pv>>16)&0xff, (pv>>8)&0xff );
-     return mbedtls_version;
+-    snprintf(mbedtls_version, sizeof(mbedtls_version), "mbed TLS %d.%d.%d",
+-             (pv>>24)&0xff, (pv>>16)&0xff, (pv>>8)&0xff );
+-    return mbedtls_version;
++    return "mbed TLS " MBEDTLS_VERSION_STRING;
+ }
+ 
+ void