Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend of mine says that the keys (private and public) for the clients shall be generated at the server and somehow delivered to the client when setting up a new client for an OpenVPN based network.

Wouldn't it be much safer to generate the keys on the client and just send the public key without the private key to the server? Or is there any reason why the server would need the private key of the client, too?

(I'm a noob at all this encryption stuff so I could be totally wrong.)

share|improve this question
up vote 2 down vote accepted

You're absolutely right.

The whole ethos of PKI is that public key (or certificate) contains everything required for a third party (your VPN server in this instance) to validate it's authenticity. The private key is required only by the client for signing these validation challenges.

Although it can make the process of enrolling new users slightly more long winded. By having each client generate their own private key and certificate signing request, you are restricting the distribution of the private keys and vastly increasing the security.

A better solution yet is to have the private keys generated by users/clients onto two-factor tokens. Nearly all contain onboard RSA engines, that enable them to generate the private key securely and stipulate that it can never leave the token.

share|improve this answer
Use scp to move the public key to "the other side". Makes it quick and easy. – Avery Payne Jul 20 '09 at 10:47

You're right on the certs -- however, for most users, the task of generating a certificate and CSR is well outside the realm of something they are going to be able to do without serious handholding.

In those circumstances, it may be easier to set up the keypair centrally, and securely transfer the key to the user during setup process.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.