I've accidentally regenerated the ca.crt and ca.key of my OPENVPN config, but did not import it into the configuration, so all previously generated keys/certificates are working fine, I just can't create additional ones.

Is it possible to export the currently used ca.crt/key back?

  • Do you have backups / copies of the old ca.{crt,key}? And which openvpn version are we talking about? The proper one, or one of the commercial ones? – MadHatter Jul 28 '15 at 6:44
  • version: 2.2.1-8+deb7 No backups – Djeux Jul 28 '15 at 10:30
  • Just to be clear: you have erased/overwritten the old ca.key file? – MadHatter Jul 28 '15 at 10:55
  • Yes, I've run ./build-ca instead of ./build-key – Djeux Jul 28 '15 at 14:07
  • Bad luck. Then kongekrabben has written what I was going to write: you're stuffed. I accept that the running daemon has knowledge of the pre-existing certificate, so it could theoretically be persuaded to give this up. But it doesn't need to know, nor does it know, the pre-existing secret key; that's simply gone. I'm afraid you've just discovered why we're always going on about backups around these parts. Hopefully, when you've finished rebuilding and re-keying your VPN, you'll learn from this, and get a good backup regimen in place. Good luck. – MadHatter Jul 28 '15 at 14:15

What you will have problems to retrieve is the ca.key. The ca.cert is distributed to the clients alongside the client.crt and client.key. You should be able to get it from there.

The ca.key on the other side not distributed and it is what is used to signing server and client certificates.

The whole point of the PKI, Public key infrastructure, is to make it practically impossible to retrieve the ca.key. So trying to regenerate the key is not something that you want to even consider.

You have to generate new certs and distribute them to the server and clients and in the future keep your ca.key and ca.crt safe.

Eventually you have to do this when the ca.crt expires, default is 10 years. That is if you do not need to create more clients before that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.