Linux Networking Cookbook

9.5. Creating Your Own PKI for OpenVPN

Problem

You want to run OpenVPN as securely as possible, so you're ready to set up a proper Public Key Infrastructure.

Solution

This isn't hard at all, and is many times more secure than using static keys. Follow these steps:

1. Create your own Certificate Authority (CA) certificate.

2. Create an OpenVPN server certificate.

3. Generate client certificates.

OpenVPN comes with a batch of scripts that make this easy. First, find the easy-rsa/2.0 directory, and copy it to /etc/openvpn:

	# cp /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/easy-rsa/2.0

Change to the 2.0 directory:

	# cd /etc/openvpn/easy-rsa/2.0

Open the vars file, and assign your own values to these lines. Don't leave any blank. Use NA if you don't want to assign your own value:

	export KEY_SIZE=2048
	export KEY_COUNTRY=US
	export KEY_PROVINCE=NA
	export KEY_CITY=Linuxville
	export KEY_ORG="Alrac.net-test"
	export KEY_EMAIL="[e-mail]"

Then, run these commands just as they are shown, and follow their prompts. After the leading dot in ../vars there is a space.

	# . ./vars
	# ./clean-all
	# ./build-ca

When it asks you for a Common Name, use something descriptive, like vpn-ca. Then, run this command to create the server certificate, naming it with your own server name:

	# ./build-key-server xena

Use the fully qualified domain name, like xena.alrac.net, for the Common Name. Answer yes to "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]."

Next, create unique ...