25

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file:

export KEY_COUNTRY=""
export KEY_PROVINCE=""
export KEY_CITY=""
export KEY_ORG
export KEY_EMAIL=""
export KEY_EMAIL=
export KEY_CN=
export KEY_NAME=
export KEY_OU=
export PKCS11_MODULE_PATH=
export PKCS11_PIN=1234

Can anyone explain these settings?

Improve this question

1 Answer 1

Reset to default
17

These are the settings for the certificate (certificate is a public key + (this) info signed by a Certificate authority).

So in your case, these are you country (where you live, where your company is), province (same), city (same), organization name, email, common name (unique for this CA), name, and organizational unit - in this order.

The last two lines are a path and a pin for PKCS11 (usually for smartcards).

I guess you're using easy-rsa; if you don't set this variables, it asks you for them, when you run the tool to generate a certificate.

Improve this answer
5
  • 3
    Thanks - what I also wanted to know was how do I come up with values for KEY_CN KEY_NAME and KEY_OU and do I keep these the same across the build_ca script and build-key-server and build-key scripts ?
    – ilium007
    Dec 16, 2012 at 1:02
  • 1
    Only CN has to be uniqe, so consider using users usernames or something simmilar. OU can be anything you wish (marketing, engineering, or even empty).
    – mulaz
    Dec 16, 2012 at 1:23
  • 1
    It seems that it's better to leave the CN unset, because otherwise you have to override it each time with: KEY_CN=foobar ./pkitool foobar when creating a key.
    – isaaclw
    Jul 3, 2013 at 2:33
  • Additional info why KEY_CN is important: in case the KEY_CN is not unique then OpenVPN starts disconnecting clients with same common name, unless duplicate-cn setting is enabled (by default it is disabled).
    – Roland Pihlakas
    Oct 19, 2017 at 2:09
  • 1
    More info, and links, in Wikipedia: en.wikipedia.org/wiki/Certificate_signing_request
    – MikeW
    Jun 5, 2019 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .