2

My company uses OpenVPN to connect our clients to our central server for easier management. Our firewall software (and theirs) has built in support for OpenVPN, and includes a generator for certificates. Recently, this generator has stopped working, and we don't know why. However it was difficult in the past anyway, so we want to try a new approach.

We'd like to just generate client certificates on a local computer with OpenVPN, instead of on the firewall software since it seems to be buggy. We have an existing Certificate Authority, and I have the full cert readable in plaintext. This obviously includes all Issuer information, modulus, signature, and the certificate itself.

My question then is, can I use OpenVPN on a Debian based Linux distro to generate client certificates off of the existing Certificate Authority? I could regenerate and sign a new CA, but I'd rather not as we have quite a few clients and updating their VPN client cert would be a hassle.

I've tried generating a CA with OpenVPN and changing the Certificate data with the one I need, but OpenVPN seems to generate a bit different than my format.

The CA and clients are PKCS12. Is this possible? Or would I have to remake everything?

Improve this question
1
  • and I have the full cert readable in plaintext - You don't need the cert. Anyone can have the cert. You need the private key associated with that CA. – Zoredache Oct 11 '16 at 22:33
4

Sure, why not?

  • Convert CA to PEM:
openssl pkcs12 -in ca.pfx -out ca.crt -clcerts -nokeys
openssl pkcs12 -in ca.pfx -out ca.key -nocerts -nodes
  • Generate 4096 bits RSA key and its CSR (certificate signing request):
openssl genrsa -out client.key 4096
openssl req -sha256 -out client.csr -key client.key -new
  • Sign with CA key:
openssl x509 -sha256 -req -days 365 -CA ca.crt -CAkey ca.key \
    -in client.csr -set_serial 01 -out client.crt
  • Convert client key/cert to PKCS12:
openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx
Improve this answer
2
  • what if I have server.p12 and dh2048.pem only? I tried to rename first one to ca.pfx but rhis seems to be wrong. – Grief Jan 4 '18 at 15:01
  • The command to sign with the CA key (and cert) is handy, but setting the serial to 01 can lead to problems, especially with certificate revocation. Here is the command that works for me: openssl x509 -sha256 -req -days 365 -CA ca.crt -CAkey ca.key -in client.csr -out client.crt -set_serial $(dd if=/dev/random bs=8 count=1 2>/dev/null| od -An -x | tr -d '[[:space:]]' | tr '[[:lower:]]' '[[:upper:]]' | sed 's/^/ibase=16; /' | bc -s) -extfile extension_settings.cnf. The extfile is for x509 v3 extensions. Please note that using shell arithmetic here is not recommended due to the integer size. – 7heo.tk Jun 14 '18 at 14:04
0

One remark: if you want that client cert to be useful for Azure you need to have the extendedKeyUsage=clientAuth extension present in the certificate. Not having that will show no errors in the log but just Azure dropping the connection after some key checks.

See https://stackoverflow.com/questions/17089889/openssl-x509v3-extended-key-usage for some pointers to add this to the certificate.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.