Los pasos son:
Hay que baypasear el archivo /etc/openssl/openssl.cnf (este fuerza esta configuración con ./demoCA para cuando usa los certificados)
cd /etc/openvpn mkdir demoCA mkdir demoCA/newcerts mkdir demoCA/private touch demoCA/index.txt echo 01 > demoCA/serial
openssl req -nodes -new -x509 -keyout ca.key -out ca.crt -days 365 cp ca.key demoCA/private/cakey.pem cp ca.crt demoCA/cacert.pem
openssl req -nodes -new -keyout server.key -out server.csr
Lo mismo para el cliente:
openssl req -nodes -new -keyout client.key -out client.csr
openssl ca -in server.csr -out server.crt openssl ca -in client.csr -out client.crt
openssl dhparam -out dh1024.pem 1024
scp ca.crt client.key client.crt dh1024.pem => cliente
| Paso | Server | Cliente |
|---|---|---|
| 1 | ca.crt – ca.key | |
| 2 | server.scr – server.key | client.csr – client.key |
| client.csr ⇐ | ||
| 3 | firmar ambos | |
| 4 | cert Diffie-H | |
| 5 | ⇒ ca.crt – client.key – client.crt – dh1042.pem | |
| ca.crt – server.crt – server.key – dh1024.pem | ca.crt – client.key – client.crt – dh1024.pem |
$ cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/