VPN certificates management

Revision as of 17:59, 15 August 2015 by WikiFreak (talk | contribs)


OpenVPN relies on the public key infrastructure principle.

Quick reminder:



Installation

The OpenVPN package provides a set of encryption-related tools called "easy-rsa".

apt-get install easy-rsa


Copy the Easy-RSA scripts into OpenVPN directory:

[Old Ubuntu - before 14.04]

cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn


[New Ubuntu distro - 14.04 and later]

cp -R /usr/share/easy-rsa/ /etc/openvpn


PKI initialization

PKI Variables

Before you can generate the public key infrastructure for OpenVPN, you must configure a few variables that the easy-rsa scripts will use to generate the scripts.

These variables are set near the end of the /etc/openvpn/easy-rsa/vars file.

vim /etc/openvpn/easy-rsa/vars


Here is an example of the relevant values:

export KEY_COUNTRY="SE"
export KEY_PROVINCE="Västra Götaland"
export KEY_CITY="Goteborg"
export KEY_ORG="daxiongmao.eu"
export KEY_EMAIL="guillaume@qin-diaz.com"

>> Alter the examples to reflect your configuration.


This information will be included in certificates you create! That must be accurate, particularly the KEY_ORG and KEY_EMAIL values.


Generate Authority of Certification (AC)

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca

When asked, use your COMPANY name as "common name".


Generate Diffie Hellman Parameters

The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server.

cd /etc/openvpn/easy-rsa/
source vars
./build-dh


VPN server

Generate server certificate

First, you need to create a certificate + private key for the VPN server.

cd /etc/openvpn/easy-rsa/
source /vars
./build-key-server [server]

→ replace server by your actual server name !


This script will also prompt you for additional information.

  • Common Name = Name of the current server (server DNS name). Ex: dev.daxiongmao.eu


Let OpenVPN access the files

The keys and certificates for the server need to be relocated to the /etc/openvpn directory so the OpenVPN server process can access them. These files are:

  • Authority of certification ca.crt
  • Authority private key ca.key
  • Diffie Hellman props dh2048.pem  !! on new distro it might be higher by default !!
  • Server certificate server.crt
  • Server private key server.key


cd /etc/openvpn/
ln -s /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/ca.crt
ln -s /etc/openvpn/easy-rsa/keys/ca.key /etc/openvpn/ca.key
ln -s /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/dh2048.pem
ln -s /etc/openvpn/easy-rsa/keys/myServer.crt /etc/openvpn/server.crt
ln -s /etc/openvpn/easy-rsa/keys/myServer.key /etc/openvpn/server.key


!! Apart from 'ca.crt', all these files mustn't leave your server, ever!!


Client certificates

Generate Clients certificates

Now you need to generate 1 private key + 1 certificate per client.

cd /etc/openvpn/easy-rsa/
source vars
./build-key [clientName]

Replace the [clientName] parameter with a relevant identifier for each client.

  • The client common name must be unique
  • It helps you to identify each client. Don’t hesitate to use meaningful name.


The name is put inside the certificate.

All other information can remain the same


Distribute client files

In order to authenticate to the VPN, you'll need to copy a number of certificate and key files to the remote client machines. They are:

  • Authority of certification ca.crt
  • Client certificate [clientName].crt
  • Client private key [clientName].key

!!! These keys should transferred with the utmost attention to security. Anyone who has the key is able to gain full access to your virtual private network !!!


Revoking Client Certificates

How to remove a user's access to the VPN server?

cd /etc/openvpn/easy-rsa/
source vars
./revoke-full [clientName]


This will revoke the ability of users who have the [clientName] certificate to access the VPN.

For this reason, keeping track of which users are in possession of which certificates is crucial.