easyrsa gen-crl Note: using Easy-RSA configuration from. If later we are going to revoke client certificates, we need to generate a CRL key: The certificate for the user has been created.Īdditionally, you have to generate a Diffie-Hellman key to be used for key exchange: You must sign it using the CA certificate, like the server key: Key: /etc/openvpn/easy-rsa/3/pki/private/admin1.key

Req: /etc/openvpn/easy-rsa/3/pki/reqs/admin1.req Writing new private key to '/etc/openvpn/easy-rsa/3/pki/private/5OY6reT2e' easyrsa gen-req admin1 nopass Note: using Easy-RSA configuration from. To generate a client key, run the following command: # openssl verify -CAfile pki/ca.crt pki/issued/ pki/issued/: OKĪll OpenVPN server certificates have been created. To make sure the certificates have been generated with no errors, run this command: To sign the certificate, we will need the password we have set when issuing the CA certificate:Īs shown in the screenshot, you will have to enter yes and CA password in process. When issuing a certificate, press Enter in the Common Name column. Key: /etc/openvpn/easy-rsa/3/pki/private/ Keypair and certificate request completed. If you enter '.', the field will be left blank.Ĭommon Name (eg: your user, host, or server name) :

There are quite a few fields but you can leave some blankįor some fields there will be a default value, What you are about to enter is what is called a Distinguished Name or a DN. You are about to be asked to enter information that will be incorporated Writing new private key to '/etc/openvpn/easy-rsa/3/pki/private/.R4IYCbD1zP' easyrsa gen-req nopass Note: using Easy-RSA configuration from. You can specify any data in the file, it will not influence the configuration and further operation of the server.Ĭreate a server key (the server name is ): Set_var EASYRSA_SSL_CONF '$EASYRSA/openssl-1.0.cnf' Set_var EASYRSA_EXT_DIR '$EASYRSA/x509-types' Set_var EASYRSA_NS_COMMENT 'CERTIFICATE AUTHORITY' Set_var EASYRSA_REQ_EMAIL EASYRSA_REQ_OU 'IT dept' Go to /etc/openvpn/easy-rsa/3/ and create the vars file there:Īdd the file contents (you can modify the config according to your needs): set_var EASYRSA '$PWD' # cp -r /usr/share/easy-rsa /etc/openvpn/ # yum install openvpn easy-rsa -y How to Configure Easy-RSA and Generate X.509 Certificates?Ĭopy all easy-rsa scripts to /etc/openvpn/:

Install openvpn access server centos