Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file:

export KEY_COUNTRY=""
export KEY_PROVINCE=""
export KEY_CITY=""
export KEY_ORG
export KEY_EMAIL=""
export KEY_EMAIL=
export KEY_CN=
export KEY_NAME=
export KEY_OU=
export PKCS11_PIN=1234

Can anyone explain these settings ? Thanks in advance.

share|improve this question
up vote 7 down vote accepted

These are the settings for the certificate (certificate is a public key + (this) info signed by a Certificate authority).

So in your case, these are you country (where you live, where your company is), province (same), city (same), organization name, email, common name (unique for this CA), name, and organizational unit - in this order.

The last two lines are a path and a pin for PKCS11 (usually for smartcards).

I guess you're using easy-rsa; if you don't set this variables, it asks you for them, when you run the tool to generate a certificate.

share|improve this answer
Thanks - what I also wanted to know was how do I come up with values for KEY_CN KEY_NAME and KEY_OU and do I keep these the same across the build_ca script and build-key-server and build-key scripts ? – ilium007 Dec 16 '12 at 1:02
Only CN has to be uniqe, so consider using users usernames or something simmilar. OU can be anything you wish (marketing, engineering, or even empty). – mulaz Dec 16 '12 at 1:23
Great - thanks ! – ilium007 Dec 16 '12 at 1:32
It seems that it's better to leave the CN unset, because otherwise you have to override it each time with: KEY_CN=foobar ./pkitool foobar when creating a key. – isaaclw Jul 3 '13 at 2:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.