View source for Linux/OpenVPN/EasyRSA

= Required key files =

Server:
* ca.crt
* dh.pem
* server.crt
* server.key
* ta.key

Clients:
* ca.crt
* client1.crt
* client1.key
* ta.key

= EasyRSA 3.x =

= EasyRSA 2.x =
== Initial setup ==
<pre>make-cadir certificates && cd certificates</pre>
* edit "vars":
<blockquote><pre>export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="me@myhost.mydomain"
export KEY_OU="MyOrganizationalUnit"</pre></blockquote>

<pre>source vars</pre>
<pre>./clean-all</pre>
<pre>./build-ca</pre>
<pre>./build-key-server server</pre>
<pre>./build-dh</pre>
<pre>openvpn --genkey --secret keys/ta.key</pre>

== Create client keys ==
<pre>source vars</pre>
<pre>./build-key client1</pre>
<pre>./build-key --batch client1</pre>

== Auto generate user config packages ==
* create $vpnname-client.ovpn template with:
** %usercrt
** %userkey
** %cacrt
** %tlskey

* /etc/openvpn/certificates/create_user.sh
<pre>
#!/bin/bash

user="$1"
vpnname="myvpn"

source vars
./build-key --batch $user

mkdir -p temp/$vpnname
cp keys/$user.crt temp/$vpnname
cp keys/$user.key temp/$vpnname
cp keys/ca.crt temp/$vpnname
cp keys/ta.key temp/$vpnname
cp client.ovpn temp/$vpnname-client.ovpn

sed -i -e "s:%usercrt:$vpnname/$user.crt:g" temp/$vpnname-client.ovpn
sed -i -e "s:%userkey:$vpnname/$user.key:g" temp/$vpnname-client.ovpn
sed -i -e "s:%cacrt:$vpnname/ca.crt:g" temp/$vpnname-client.ovpn
sed -i -e "s:%tlskey:$vpnname/ta.key:g" temp/$vpnname-client.ovpn

cd temp
zip -r $vpnname-$user.zip *
cd ..

cp temp/$vpnname-$user.zip /srv/openvpn/userconfigs

rm -r temp
</pre>