6

I've just managed to setup OpenVPN properly on my server and test it to be properly working with client computers and I came to wonder how OpenVPN keys can be generated as clients come and go.

Is it necessary to rebuild the Diffie-Hellman .dh file and recreate all previous client keys as I just need to add or remove a client?

Thanks

Improve this question

5 Answers 5

Reset to default
8

As Ency says, provided you've created your own CA, you simply create another key for the new user. Before any more gets typed, when you set up openVPN you did create your own CA, as recommended, didn't you?

Edit: OK, then

cd easy-rsa
. ./vars
./build-key newclient

I also have some notes somewhere about making a CRL, which allows you to revoke old certificates, and pointing openVPN at the crl, but I can't immediately find them.

Improve this answer
7
  • Yep! I did - the ca.crt file have been proven to be working!
    – Industrial
    Jan 31, 2011 at 12:47
  • Hi again. Thanks for your edit, but doesn't this mean I have to rebuild the diffie helman? What would I need to do when I need to revoke access?
    – Industrial
    Jan 31, 2011 at 16:34
  • You could rebuild the main CA key and redistribute it, or you can make a CRL - Certificate Revocation List. This is a list of certificates which despite being validly signed are no longer valid, in a very particular format, and also signed by your CA certificate. The openVPN doco will point you at how to do it, it's not complex, just fiddly. Once you've reconfigured your opeVPN server to use your CRL, keeping your CRL up-to-date is fairly straightforward.
    – MadHatter
    Jan 31, 2011 at 18:10
  • So only the CA key would need to be redistributed and no other keys?
    – Industrial
    Jan 31, 2011 at 19:58
  • If you regenerate the CA, all keys will have to be redistributed (because the root signing key will be new, so all the other keys will need re-signing). If you create a CRL, no keys have to be redistributed.
    – MadHatter
    Jan 31, 2011 at 21:10
1

My solution is:
I have got my own Certificate Authority and anytime I need new client I just create another certificate. It is simple and I am pretty sure you can do same thing even with easyRSA delivered with openVPN.
It is also more universal, because you can easily manage certificates for another services such as apache, etc.

Improve this answer
2
  • How does that work with revoking access to a client?
    – Industrial
    Jan 31, 2011 at 19:00
  • There is a CRL list and you can easily revoke any certificate and I am using this command openssl ca -config conf/openssl.cnf -revoke newcerts/XX.pem -keyfile private/ca.key -cert ca/ca.crt, list of certificates is stored in index.txt (of course depends on your openSSL config)
    – Ency
    Jan 31, 2011 at 20:18
0

Use duplicate-cn option and one key for all client or use easy-rsa for create user certification.

Improve this answer
2
  • 1
    That would mean that I had to redistribute a new key to all clients if I need to restrict access to one user?
    – Industrial
    Jan 31, 2011 at 12:18
  • Yes that is correct !
    – Antoine Benkemoun
    Jan 31, 2011 at 12:56
0

You can also tie the CN (that houses the user login name) of the user cert to a login that you can administer, for example, with FreeRADIUS. I wrote a small integration script couple of years ago. This way you can simply block user access by removing them from FreeRADIUS user list. The idea is that the certificate will protect the VPN from anyone else, and the FreeRADIUS login from the user itself (should the user's login need to be revoked). You can find the script and additional detail here.

Improve this answer
0

Tested on OpenVPN 2.4.7 on Windows 7. I followed those steps:

  1. Open CMD with Admin Rights.
  2. Move to easy-rsa directory, within OpenVPN directory.
  3. Run vars.bat.
  4. Run clean-all.bat.
  5. Make sure ca.key and ca.crt in the directory keys, which has just been created by the clean-all.bat.
  6. Run build-key A_New_Client.
  7. There will be A_New_Client.crt, A_New_Client.csr and A_New_Client.key. Those are the files specific to the new client. Copy them somewhere.
  8. For safety reasons, shred the directory keys above.

It is assumed that vars.bat hasn't been changed since the last time, especially the key size part, as well as openssl-1.0.0.cnf is kept default.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.