My company uses OpenVPN to connect our clients to our central server for easier management. Our firewall software (and theirs) has built in support for OpenVPN, and includes a generator for certificates. Recently, this generator has stopped working, and we don't know why. However it was difficult in the past anyway, so we want to try a new approach.
We'd like to just generate client certificates on a local computer with OpenVPN, instead of on the firewall software since it seems to be buggy. We have an existing Certificate Authority, and I have the full cert readable in plaintext. This obviously includes all Issuer information, modulus, signature, and the certificate itself.
My question then is, can I use OpenVPN on a Debian based Linux distro to generate client certificates off of the existing Certificate Authority? I could regenerate and sign a new CA, but I'd rather not as we have quite a few clients and updating their VPN client cert would be a hassle.
I've tried generating a CA with OpenVPN and changing the Certificate data with the one I need, but OpenVPN seems to generate a bit different than my format.
The CA and clients are PKCS12. Is this possible? Or would I have to remake everything?
and I have the full cert readable in plaintext
- You don't need the cert. Anyone can have the cert. You need the private key associated with that CA. – Zoredache Oct 11 '16 at 22:33