I'm setting up a small vpn service for 10 - 100 expats so they can access normally blocked sites. I would like them to be able to sign up via my website, which upon payment the site will generate their client.cert, client.key and client.conf and perhaps a tp.key and will be delivered in some secure, yet to be decided, method.
The problem is to generate these I need to have the ca.crt and ca.key to hand. The ca.key is supposed to be kept locked up in a ultra secure location offline. Keeping it on my web server seems to be asking for trouble. Since other big vpn providers seem to be able to generate keys instantly how are they doing it whilst keeping the key in a safe place - or aren't they?
Finally I was thinking I should maybe keep the openvpn server and the signup website on different servers - is that necessary?