up vote 1 down vote favorite
share [g+] share [fb]

From answers to this question ive been recommended to not create client keys on the server home to ca.key but rather make the clients create their own private key and simple pass a csr to the ca server to be signed and get it back. This way private keys do not have to be distributed.

Ive googled quite a fair few terms and phrases but i havnet hit anything regarding how to do this. Ive looked at the howto on openvpn and though it discusses this option, it doesnt say how. Can anyone point me to any tutorials etc?

Id also like to know how easy this would be to do for clients, especially if they arent so hot with computers.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 2 down vote accepted

There are a couple of ways.

  1. What we do most commonly, because most of our certificates are issued straight onto hardware tokens and the end users are Windows/IE based, is to automagically generate the key and request from the browser using MS CAPI. It's pretty foolproof and utterly low touch. This would suit you if your users are Windows based and you intend for the certificates to be installed in the local certificate store. Once the certificate is signed then you can provide them a link to collect their certificate and place it straight back into the store alongside the existing private key.

  2. Alternatively, something that we do for non-Wintel users, is to provide them with a complete command that they can copy and run to generate the required output. Typically this is OpenSSL for us but you could reference the utilities packaged with OpenVPN since they should already have that installed. Then they paste the CSR back into a web form, it receives some simple validation and sent back for signing. You then return them the CRT with final instructions of what to do.

My experience is that you need to provide users with details of "what to do" in the least amount of instructions possible. Try to do as much of the work for them as possible and restrict the scope for misinterpretation.

link|improve this answer
1) Sounds extremely cool, but I've no idea where I'd start looking for how to do it ... – pjc50 Oct 7 '09 at 11:29
it does sound cool and extremely slick though i think its out of my reach. Perhaps if my nubmers grow i can look more into that or even outsource. Thanks Dan for all your help on both my questions! – adam Oct 7 '09 at 13:30
We did something similar to 2 where I worked. We rolled our own installation package with everything pre-configured as much as possible. Then used the MyCertificateWizard app with most fields pre-populated so that the end user only had to put in their email address and choose a password for their key. Then just had them email us their csr. We would verify that they used their work email address and then emailed them back their cert with instructions on how to install it and update the configuration files to use it. – 3dinfluence Oct 7 '09 at 14:11
Like my answer to the other topic, option #1 wasn't the cheapest to implement. But it was eventually deemed necessary given the size. MyCertificateWizard looks pretty good for the purpose. One of the things we're had to be especially careful about is the validation. Always make sure that the CSR content is as expected before you accept it for signing. – Dan Carley Oct 8 '09 at 8:34
feedback
up vote 1 down vote

Specially i build client’s key and certificate in a remote machine that differ from the openvpn server. You can find here a nice tuto, i hope that can help you http://www.throx.net/2008/04/13/openvpn-and-centos-5-installation-and-configuration-guide/

link|improve this answer
thanks for your link. Ill going to give that a good read after a coffee break! – adam Oct 7 '09 at 13:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.