R7000 VPN requires fixed IP or limited DDNS and old TLS. Will FreshTomato fix the old TLS?

The R7000 has been a wonderful router.  The straw that broke the camel's back is when I was setting up a VPN and ran into the old TLS protocol issue even with the latest firmware.  Then there is the choice between an IP address that might change being part of the cert or limited DynDNS options.  These days control panels like cPanel have DDNS support.  This got me looking at what FreshTomato has to offer and it looks good.  The question is, is the TLS support in the firmware or part of the chipset that would not be upgraded?

Thanks for taking your time to read this!

PS:  I don't mind buying a new router, but now that I read about FreshTomato, there are features in there that I want for either a new or older router.