Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have OpenVPN set up and working fine, however I want to add a new client key to it. Going off of the documentation, I issued the following commands with the following output on a CentOS box.

$ cd /etc/openvpn/easy-rsa
$ source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
$ ./pkitool client-new
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.

It also says the same thing if I try the command ./build-key client-new. Any idea on why I can't do that? I need to keep all of my other keys, I just need one more. Thanks for the help.

share|improve this question


. ./vars

that loads the variables that are in the vars file.

I don't know why, if someone could explain why. I thought ./vars would just run all commands in the script, including the exports, so they would be in your env. Anywhay, putting an extra . in front of the command works for me.

share|improve this answer
I tried doing that as well and I get the same output. – user15736 Aug 6 '09 at 13:31
actually you may need to load the vars via source ../vars :) – tftd Sep 23 '12 at 22:33

I changed some directory information in the vars file and that ended up fixing the problem. It was using pwd as the directory for EASY_RSA and if you were in the wrong directory it had some weird issues. Once that problem was fixed I received another error that was easily fixed. I had the ca.key encrypted for security purposes and it was complaining about not being able to read that but that was a simple decrypt fix. Thanks for the help.

share|improve this answer

If you're using OpenVPN 2.x you might check whether you are making changes in the correct directory, possibly you may need to be working in:


I don't know how CentOS packages their install, but I've seen the above as the solution in a few places.

You should be able to determine the correct scripts by looking at the 'vars' scripts finding out which one points the KEY_DIR variable to the one you actually use (e.g. /etc/openvpn/keys, or /etc/openvpn/easy-rsa/keys, or /etc/openvpn/easy-rsa/2.0/keys)

Within the `vars' script verify the following 'variables' will have meaningful evaluations.

KEY_CONFIG - should end up pointing to a valid file (hopefully a proper openssl.cnf file)

For example, I 'hardwire' mine to be 'export KEY_CONFIG=/etc/openvpn/openssl.cnf'

KEY_DIR - this should point to you keys directory (possibly: /etc/openvpn/keys

another example, 'export KEY_DIR="/etc/openvpn/keys"'

Once that's working your next steps will be to

 $ sudo su
 # cd /etc/openvpn/easy-rsa/2.0
 # . ./vars
 # ./build-key new-client-name

The warning message will always come up after running . ./vars

share|improve this answer

if you have a certificate file you can use PuttyGen.exe to load it and export the public and private keys separately. That might help you?

Some instructions here to use PuttyGen.exe , if you can click this link:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.