I have an OpenVPN server installed on a Debian machine.
Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
For keys without a password, the actual key usually starts at the second line and for keys with a password you can also find three additional lines.
You can do something like
Deleting the keys doesn't do anything in OpenVPN and users would still be able to connect with their certificate and key. You need to revoke the certificate of the user that you want to prevent from connecting.
You can use the
This attempts to decrypt the file with an empty passphrase, which works fine on unencrypted keys but will otherwise fail. See the "PASS PHRASE ARGUMENTS" section of the
OpenVPN uses SSL/TLS for its secutity, and so it uses SSL certificates and keys (that's why your question actually has nothing to do with OpenVPN). OpenVPN uses OpenSSL for dealing with (almost) all the security stuff, and its
So, stictly speaking, you should process each key file with a script which would try to perform some minimal amount of parsing: detect the header line (that
Note that it's strange why do you have clients' keys on the server: the server does not need neither the clients' keys nor their certificates—all it's interested in is access to these bits of information:
The whole idea of OpenVPN trusting some but not all clients is rooted in the fact it only lets in those clients which present it valid certificates issued by the CA which the server trusts—most of the time it's the same CA which issued the server's certificate as well. There are ways to limit this, though:
Hence there's no need to keep client keys on the server: should a client lost their certificate and/or its key, your CA has to revoke it (updating the CRL) and issue another one. So keeping clients' public certificates around might be useful (for easier revocation) but even this is not required.