I have OpenVPN set up and working fine, however I want to add a new client key to it. Going off of the documentation, I issued the following commands with the following output on a CentOS box.

$ cd /etc/openvpn/easy-rsa
$ source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
$ ./pkitool client-new
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.

It also says the same thing if I try the command ./build-key client-new. Any idea on why I can't do that? I need to keep all of my other keys, I just need one more. Thanks for the help.



. ./vars

that loads the variables that are in the vars file.

I don't know why, if someone could explain why. I thought ./vars would just run all commands in the script, including the exports, so they would be in your env. Anywhay, putting an extra . in front of the command works for me.

  • I tried doing that as well and I get the same output. – user15736 Aug 6 '09 at 13:31
  • 1
    actually you may need to load the vars via source ../vars :) – tftd Sep 23 '12 at 22:33

I changed some directory information in the vars file and that ended up fixing the problem. It was using pwd as the directory for EASY_RSA and if you were in the wrong directory it had some weird issues. Once that problem was fixed I received another error that was easily fixed. I had the ca.key encrypted for security purposes and it was complaining about not being able to read that but that was a simple decrypt fix. Thanks for the help.


If you're using OpenVPN 2.x you might check whether you are making changes in the correct directory, possibly you may need to be working in:


I don't know how CentOS packages their install, but I've seen the above as the solution in a few places.

You should be able to determine the correct scripts by looking at the 'vars' scripts finding out which one points the KEY_DIR variable to the one you actually use (e.g. /etc/openvpn/keys, or /etc/openvpn/easy-rsa/keys, or /etc/openvpn/easy-rsa/2.0/keys)

Within the `vars' script verify the following 'variables' will have meaningful evaluations.

KEY_CONFIG - should end up pointing to a valid file (hopefully a proper openssl.cnf file)

For example, I 'hardwire' mine to be 'export KEY_CONFIG=/etc/openvpn/openssl.cnf'

KEY_DIR - this should point to you keys directory (possibly: /etc/openvpn/keys

another example, 'export KEY_DIR="/etc/openvpn/keys"'

Once that's working your next steps will be to

 $ sudo su
 # cd /etc/openvpn/easy-rsa/2.0
 # . ./vars
 # ./build-key new-client-name

The warning message will always come up after running . ./vars


if you have a certificate file you can use PuttyGen.exe to load it and export the public and private keys separately. That might help you?

Some instructions here to use PuttyGen.exe , if you can click this link: http://www.newartisans.com/2007/09/how-to-administer-openvpn.html


I had this problem with a fresh install of easy-rsa from the ubuntu (16.04) repository.

For me, the solution was to create the keys directory. I also needed to create index.txt and initialize serial.

So after

source ./vars

The KEY_DIR environment variable specifies a directory that needs to exist, which I had to create and initialize.

mkdir -p $KEY_DIR

touch $KEY_DIR/index.txt

echo '1' > $KEY_DIR/serial


Check your permissions to the requires easy-rsa folders and /etc/ssl... In my case I had to run this as root: sudo su Not ideal, and be sure to 'exit' when finished to close the root terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy