Ekaanbj: /* Generate certificates & keys for client */

2010-09-05T04:24:13Z

Generate certificates & keys for client

New page

==Generate the master Certificate Authority (CA) certificate & key==

sudo rsync -a /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/

/etc/openvpn/easy-rsa/vars
set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters.
. ./vars
./clean-all
./build-ca

Answer yes on everything exept:

==Generate certificate & key for server==

When the Common Name is queried, enter "server"
./build-key-server server

Generate Diffie Hellman parameters
./build-dh

HMAC firewall
cd /etc/openvpn/easy-rsa/keys && openvpn --genkey --secret ta.key

==Generate certificates & keys for client==
Howto create a new client config.
cd /etc/openvpn/easy-rsa/
. vars
./build-key rollewrt
cp keys/rollewrt.* /etc/openvpn/blt/
cd /etc/openvpn/blt
cp blt_olle.ovpn blt_rollewrt.ovpn
vim blt_rollewrt.ovpn
for i in rollewrt ;do echo $i ;tar czf /tmp/openvpn-client-$i-blt.homeip.net.tar.gz $i.* ca.crt ta.key blt_$i.ovpn;done

for i in bob ;do echo $i ;tar czf /tmp/openvpn-client-$i-www.halfface.se.tar.gz $i.* ca.crt ta.key halfface_$i.ovpn;done

==Key Files==

Now we will find our newly-generated keys and certificates in the keys subdirectory. Here is an explanation of the relevant files:
Filename Needed By Purpose Secret
ca.crt server + all clients Root CA certificate NO
ca.key key signing machine only Root CA key YES
dh{n}.pem server only Diffie Hellman parameters NO
server.crt server only Server Certificate NO
server.key server only Server Key YES
client1.crt client1 only Client1 Certificate NO
client1.key client1 only Client1 Key YES

==setup server and client==
===server===
Copy example configuration files.
mkdir /etc/openvpn/config; cp /usr/share/doc/openvpn-2.1/sample-config-files/{client,server}.conf /etc/openvpn/config
Copy keys to location.
cp -p ca.crt server.crt server.key dh1024.pem ta.key ../..
Edit server.conf
# change this value to the network behind the openvpn server
push "route 192.168.0.0 255.255.255.0"
# Enable clients to comunicate with each other.
client-to-client
# Enable hmac firewall.
tls-auth ta.key 0 # This file is secret

Copy server.conf to location:
cp /etc/openvpn/config/server.conf /etc/openvpn

Edit client.conf and save as /etc/openvpn/blt
# Change to name of openvpn server.
remote blt.homeip.net 1194
# Change path to certificates.
ca blt/ca.crt
cert blt/bjorklun.crt
key blt/bjorklun.key
# Enable hmac firewall.
tls-auth ta.key 1

Copy certificates.
cp -p /etc/openvpn/easy-rsa/keys/{ca.crt,bjorklun.*,ta.key} /etc/openvpn/blt/

Create openvpn config to transfer to client.
for i in rolle olle strate;do echo $i ;tar czf /install/program/windows/openvpn/openvpn-client-$i-blt.homeip.net.tar.gz $i.* ca.crt ta.key blt_$i.ovpn;done

==Route a client network.==
/etc/openvpn/server.conf:route 192.168.10.0 255.255.255.0
/etc/openvpn/server.conf:push "route 192.168.10.0 255.255.255.0"
/etc/openvpn/ccd/rollewrt:iroute 192.168.10.0 255.255.255.0

[[Category:Applications]]
[[Category:Unix]]
[[Category:Vpn]]

OpenVPN - Revision history

Ekaanbj: /* Generate certificates & keys for client */