0

I mistakenly deleted keys folder with ca.cert, server.key and dh2048.perm. I have multiple clients located various places which are still connecting with server.

I want to generate new set of ca.cert,server.key and dh2048.perm and client keys without affecting those clients which are already connecting with the server. What could be the feasible solution?

Is it okay to go ahead and use build-server-key, build-ca and build-dh for new clients that I will deploy on the same server or do I need to have a complete different setup? I am not sure how old clients are still connecting!

Thanks in advance!

1 Answer 1

0

Have you restarted your OpenVPN server? If you didn't that would explain why the clients are able to connect: the server has read the files you deleted at its startup and so it's able to verify the certificates presented by the clients (the server only needs to have the contents of the CA certificate to verify them).

Regarding the feasible solution…

Well, one way is to create another OpenVPN instance listening on a separate port (say, on Debian and its derivatives this works out of the box — by creating another configuration file with a different port(s) configured). You should create a completely different CA setup (PKI) for that istance.

You could then re-roll the key+certificate pair for all the existing clients using that new CA and deploy them — with the necessary tweaks in their configuration files to account for a different server port — on the existing clients, effectively switching them over to the new server.

After that update you can reconfigure the original OpenVPN instance to use the new CA setup — basically just making its configuration identical to the second instance, modulo the original port(s).

After that switchover you'll end up with two identical OpenVPN instances which only differ in the ports they listen on. So you can then iterate over your clients once again — this time changing the configured ports back to target the original instance.

After that sequence is completed, you'll have all the clients updated.

TL;DR

  1. Create a new PKI.
  2. Setup a separate OpenVPN instance using that PKI.
  3. Re-roll new key+cert+CA cert bundles for the existing clients.
  4. Update the existing clients with those bundles, retargeting them to the new OpenVPN instance one-by-one.
  5. Reconfigure the original instance to use the new PKI.
  6. Update the existing clients to target the original instance again.
2
  • Thank you @kostix for detailed solution. No, I have not restarted the server and hence as you mentioned deployed clients are still working. Only problem with re-configuring clients is that those are already deployed geographically different place and we can not get them back. Is it okay to create another instance on the same server and continue with that new CA-setup for rest of the clients? Oct 6, 2017 at 12:57
  • @DarshanJoshi, yes but as soon as you restart your working instance, the existing clients seize to work. I'm afraid, you might want to do some "remotely-controlled" work on the clients. Is it possible to update them via some remote-access admin solution (like TeamViewer) or some such?
    – kostix
    Oct 6, 2017 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .