Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up an openvpn server on ec2 following the directions here:

That all works great.

I'd like to change this to use asymmetric keys, and allow multiple client connections, but I'm finding the openvpn documentation hard to get follow. Anyone know of a good tutorial that could bridge the gap for me?

Is it possible to setup openvpn to use people's existing ssh keys?

share|improve this question

I don't think you're going to find a way to use existing SSH keys with OpenVPN. OpenVPN needs X.509 certificates to operate, and I don't believe that OpenSSH will use x.509 certificates w/o patching (see

The key to understanding OpenVPN and assymetric encryption is to understand how a PKI works. The OpenVPN server is configured with its own certificate, and accepts client certificates only if they're signed by the same CA as has signed its own certificate.

In the official HOWTO ( you're run through creating a CA public/private key pair and certificate (the "master CA" as the doc refers to it) and then creating certificates for the server and 3 clients. You don't have to do this on the OpenVPN server machine (and, in fact, it's a good idea not to).

The HOWTO has you use some scripts in the OpenVPN distribution to manipulate the OpenSSL command-line tools (the "easy-rsa" scripts). If you can spend some time getting comfortable with the OpenSSL command line tool you'll have even better luck. For playing around, the easy-rsa scripts and the HOWTO are fine.

For the best security you'll create a CA on an offline computer (i.e. no or minimal network connectivity) and certificate requests (public/private key pairs) on the OpenVPN server and each client. You'll ship the certificate requests to the CA through some means, sign the requests at the CA, then ship the resulting certificates back to the various machines. That keeps the private keys from ever crossing the wire and keeps the CA safe from compromise.

share|improve this answer

Take a look at the howto at ubuntu: Its easy to understand and works great! For multiple clients just create a new client config and keys for each user and replace the config and key names with the username.

share|improve this answer

Take a look at this HOWTO: - Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients

that's probably what you want... when you finish it you must have in your server config something like this (among others):

ca ca.crt cert server.crt key server.key

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.