Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there any documentation or resource describing how to generate and host a profile for an OpenVPN client to import? Ideally would like my users to not have to separately fetch a .zip file of the .ovpn + certs, extract it to the proper directory, tweak their .ovpn, etc.

share|improve this question

2 Answers 2

Apparently since OpenVPN 2.1 a inline configuration has been supported. Allowing you to locate your certs, and keys all in a single configuration file. But the documentation about how to create this configuration file was not added until the recent release of 2.3.

https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

client
proto udp
remote openvpnserver.example.com
port 1194
dev tun
nobind

key-direction 1

<ca>
-----BEGIN CERTIFICATE-----
# insert base64 blob from ca.crt
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
# insert base64 blob from client1.crt
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
# insert base64 blob from client1.key
-----END PRIVATE KEY-----
</key>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
# insert ta.key
-----END OpenVPN Static key V1-----
</tls-auth>
share|improve this answer
    
Couldn't get it to work with the Windows Connect Client (openvpn.net/?option=com_content&id=357), it complains about something like Could not read file C:\\...\[inline] so it seems that the client does not know about inline certificates (yet). –  Patrick Oscity Jun 1 '13 at 19:39
    
Don't know if it helps, but I just left the ca, cert, key and tls-auth config values out and it works. –  Ikke Sep 26 '13 at 20:00
1  
You should remove the lines with [inline]. Instead of tls-auth [inline] 1 you should use tls-direction 1 –  plaisthos Sep 30 '13 at 13:43
    
@plaisthos can you point me at some reference for this new tls-direction option? Like inline certificates it doesn't appear to be documented anywhere. I really wish someone would get the man pages updated to describe the correct syntax. –  Zoredache Sep 30 '13 at 17:01
    
Sorry it is key-direction 1. Got that mixed up. My patch to the man page has already been integrated. See the 2.3 man page under INLINE FILES: community.openvpn.net/openvpn/wiki/Openvpn23ManPage. I copied it to its own answer to make it make readable and accessable. –  plaisthos Oct 1 '13 at 15:19

From the OpenVPN 2.3 man page (It is support since 2.1rc-something):

OpenVPN allows including files in the main configuration for the --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth options.

Each inline file started by the line and ended by the line

Here is an example of an inline file usage

<cert>
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
</cert>

When using the inline file feature with --pkcs12 the inline file has to be base64 encoded. Encoding of a .p12 file into base64 can be done for example with OpenSSL by running openssl base64 -in input.p12

Also Note the key-direction option:

Alternative way of specifying the optional direction parameter for the --tls-auth and --secret options. Useful when using inline files (See section on inline files).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.