I have two vpn hosts, vpn1 being the primary, vpn2 being a hot failover machine for cases where vpn1 goes down, either planned or unplanned.
Right now, we manage client keys using the easy-rsa shell script package provided by openvpn, but the process put into place by my predecessor is to run the build key script on vpn1, and then run it again on vpn2 with the same answers, but only giving out the key/crt from vpn1 to the client.
This seems wrong to me, on two levels: One, I don't think that this will work at all; the key from the vpn1 is not likely to work to authenticate to vpn2 this way, and two, it's a lot of extra work.
I would prefer to synchronize key stores between the two machines. Is this possible? If so, what do I need to ensure is in sync between the two machines?