6

I've just managed to setup OpenVPN properly on my server and test it to be properly working with client computers and I came to wonder how OpenVPN keys can be generated as clients come and go.

Is it neccessary to rebuild the diffie helman .dh file and recreate all previous client keys as I just need to add or remove a client?

Thanks

Improve this question
8

As Ency says, provided you've created your own CA, you simply create another key for the new user. Before any more gets typed, when you set up openVPN you did create your own CA, as recommended, didn't you?

Edit: OK, then

cd easy-rsa
. ./vars
./build-key newclient

I also have some notes somewhere about making a CRL, which allows you to revoke old certificates, and pointing openVPN at the crl, but I can't immediately find them.

Improve this answer
7
  • Yep! I did - the ca.crt file have been proven to be working! – Industrial Jan 31 '11 at 12:47
  • Hi again. Thanks for your edit, but doesn't this mean I have to rebuild the diffie helman? What would I need to do when I need to revoke access? – Industrial Jan 31 '11 at 16:34
  • You could rebuild the main CA key and redistribute it, or you can make a CRL - Certificate Revocation List. This is a list of certificates which despite being validly signed are no longer valid, in a very particular format, and also signed by your CA certificate. The openVPN doco will point you at how to do it, it's not complex, just fiddly. Once you've reconfigured your opeVPN server to use your CRL, keeping your CRL up-to-date is fairly straightforward. – MadHatter Jan 31 '11 at 18:10
  • So only the CA key would need to be redistributed and no other keys? – Industrial Jan 31 '11 at 19:58
  • If you regenerate the CA, all keys will have to be redistributed (because the root signing key will be new, so all the other keys will need re-signing). If you create a CRL, no keys have to be redistributed. – MadHatter Jan 31 '11 at 21:10
1

My solution is:
I have got my own Certificate Authority and anytime I need new client I just create another certificate. It is simple and I am pretty sure you can do same thing even with easyRSA delivered with openVPN.
It is also more universal, because you can easily manage certificates for another services such as apache, etc.

Improve this answer
2
  • How does that work with revoking access to a client? – Industrial Jan 31 '11 at 19:00
  • There is a CRL list and you can easily revoke any certificate and I am using this command openssl ca -config conf/openssl.cnf -revoke newcerts/XX.pem -keyfile private/ca.key -cert ca/ca.crt, list of certificates is stored in index.txt (of course depends on your openSSL config) – Ency Jan 31 '11 at 20:18
0

Use duplicate-cn option and one key for all client or use easy-rsa for create user certification.

Improve this answer
2
  • 1
    That would mean that I had to redistribute a new key to all clients if I need to restrict access to one user? – Industrial Jan 31 '11 at 12:18
  • Yes that is correct ! – Antoine Benkemoun Jan 31 '11 at 12:56
0

You can also tie the CN (that houses the user login name) of the user cert to a login that you can administer, for example, with FreeRADIUS. I wrote a small integration script couple of years ago. This way you can simply block user access by removing them from FreeRADIUS user list. The idea is that the certificate will protect the VPN from anyone else, and the FreeRADIUS login from the user itself (should the user's login need to be revoked). You can find the script and additional detail here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.