Difference between revisions of "VPN certificates management"

(Created page with "Category:Linux OpenVPN relies on the '''public key infrastructure''' principle. Quick reminder: * [https://www.youtube.com/watch?v=E5FEqGYLL0o What is a key? High over...")
 
 
(13 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
[[Category:Linux]]
 
[[Category:Linux]]
 +
 +
{| style="margin: 1em auto 1em auto"
 +
|-valign="top"
 +
|width="30%"|[[File:Pki-icon.png|link=VPN certificates management#PKI initialization|64px|caption|Setup PKI]]
 +
[[VPN certificates management#PKI initialization|Setup PKI]]
 +
|width="30%"| [[File:Server-certificate-icon.png|link=VPN certificates management#VPN server|64px|caption|VPN server certificate]]
 +
[[VPN certificates management#VPN server|VPN server certificate]]
 +
|width="30%"| [[File:Client-certificate-icon.png|link=VPN certificates management#Client certificates|64px|caption|Clients certificates]]
 +
[[VPN certificates management#Client certificates|Clients certificates]]
 +
|}
 +
 +
  
 
OpenVPN relies on the '''public key infrastructure''' principle.   
 
OpenVPN relies on the '''public key infrastructure''' principle.   
Line 8: Line 20:
  
  
 +
=Installation=
  
 
The OpenVPN package provides a set of encryption-related tools called "easy-rsa".  
 
The OpenVPN package provides a set of encryption-related tools called "easy-rsa".  
  
−
These scripts are located by default in the <code>/usr/share/doc/openvpn/examples/easy-rsa/</code> directory.
+
<syntaxhighlight lang="bash">
−
 
+
apt-get install easy-rsa
−
However, in order to function properly, these scripts should be located in the <code>/etc/openvpn</code> directory.
+
</syntaxhighlight>
  
  
−
=Installation=
 
  
−
Copy these files with the following command:
+
Copy the Easy-RSA scripts into OpenVPN directory:
  
 
[Old Ubuntu - before 14.04]
 
[Old Ubuntu - before 14.04]
Line 29: Line 41:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cp -R /usr/share/easy-rsa/ /etc/openvpn
 
cp -R /usr/share/easy-rsa/ /etc/openvpn
 +
# You must add a symlink manually, depending on the OpenSSL version you want to use
 +
ln -s /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf
 
</syntaxhighlight>
 
</syntaxhighlight>
  
Line 50: Line 64:
  
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
−
export KEY_COUNTRY="SE"
+
# 2016
−
export KEY_PROVINCE="Västra Götaland"
+
# If you put '4096' it might take a very long time to generate the Diffie Hellman key (more than 30h on a raspberry pi 2)
−
export KEY_CITY="Goteborg"
+
export KEY_SIZE=2048
 +
# Certificate owner
 +
export KEY_COUNTRY="LU"
 +
export KEY_PROVINCE=""
 +
export KEY_CITY="Luxembourg"
 
export KEY_ORG="daxiongmao.eu"
 
export KEY_ORG="daxiongmao.eu"
 
export KEY_EMAIL="guillaume@qin-diaz.com"
 
export KEY_EMAIL="guillaume@qin-diaz.com"
 +
 
</syntaxhighlight>
 
</syntaxhighlight>
  
Line 61: Line 80:
  
 
This information will be included in certificates you create! That must be accurate, particularly the KEY_ORG and KEY_EMAIL values.
 
This information will be included in certificates you create! That must be accurate, particularly the KEY_ORG and KEY_EMAIL values.
−
 
  
 
==Generate Authority of Certification (AC)==
 
==Generate Authority of Certification (AC)==
Line 67: Line 85:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cd /etc/openvpn/easy-rsa/
 
cd /etc/openvpn/easy-rsa/
−
. /etc/openvpn/easy-rsa/vars
+
source vars
−
. /etc/openvpn/easy-rsa/clean-all
+
./clean-all
−
. /etc/openvpn/easy-rsa/build-ca
+
./build-ca
 
</syntaxhighlight>
 
</syntaxhighlight>
  
−
When asked, use your COMPANY name as "common name".
+
 
 +
This an example of replies:
 +
* Country Name (2 letter code) [LU]: '''LU'''
 +
* State or Province Name (full name) []:
 +
* Locality Name (eg, city) [Luxembourg]: '''Luxembourg'''
 +
* Organization Name (eg, company) [Daxiongmao]: '''Daxiongmao'''
 +
* Organizational Unit Name (eg, section) [Personal_usage]: '''Personal_usage'''
 +
* Common Name (eg, your name or your server's hostname) [Daxiongmao CA]: '''Daxiongmao CA'''
 +
* Name [EasyRSA]: '''Daxiongmao_CA'''
 +
* Email Address [guillaume@daxiongmao.eu]: '''guillaume@daxiongmao.eu'''
 +
 
  
  
−
===Generate Diffie Hellman Parameters===
+
==Generate Diffie Hellman Parameters==
  
 
The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server.  
 
The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server.  
Line 81: Line 109:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cd /etc/openvpn/easy-rsa/
 
cd /etc/openvpn/easy-rsa/
−
. /etc/openvpn/easy-rsa/build-dh
+
source vars
 +
./build-dh
 
</syntaxhighlight>
 
</syntaxhighlight>
  
  
  
−
=VPN server Certificate=
+
=VPN server=
 +
 
 +
 
 +
==Generate server certificate==
  
 
First, you need to create a certificate + private key for the VPN server.
 
First, you need to create a certificate + private key for the VPN server.
Line 92: Line 124:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cd /etc/openvpn/easy-rsa/
 
cd /etc/openvpn/easy-rsa/
−
source /etc/openvpn/easy-rsa/vars
+
source /vars
−
. /etc/openvpn/easy-rsa/build-key-server [server]
+
./build-key-server [server]
 
</syntaxhighlight>
 
</syntaxhighlight>
  
 
→ replace server by your actual server name !
 
→ replace server by your actual server name !
 +
 +
 +
Example
 +
* Country Name (2 letter code) [LU]: '''LU'''
 +
* State or Province Name (full name) []:
 +
* Locality Name (eg, city) [Luxembourg]: '''Luxembourg'''
 +
* Organization Name (eg, company) [Daxiongmao]: '''Daxiongmao'''
 +
* Organizational Unit Name (eg, section) [Personal_usage]: '''Personal_usage'''
 +
* Common Name (eg, your name or your server's hostname) [code.daxiongmao.eu]: '''code.daxiongmao.eu'''
 +
* Name [EasyRSA]:'''VPN server code.daxiongmao.eu'''
 +
* Email Address [guillaume@daxiongmao.eu]: '''guillaume@daxiongmao.eu'''
 +
  
  
Line 103: Line 147:
  
  
−
=Server files access=
+
==Let OpenVPN access the files==
  
 
The keys and certificates for the server need to be relocated to the <code>/etc/openvpn</code> directory so the OpenVPN server process can access them. These files are:
 
The keys and certificates for the server need to be relocated to the <code>/etc/openvpn</code> directory so the OpenVPN server process can access them. These files are:
 
* Authority of certification ca.crt
 
* Authority of certification ca.crt
 
* Authority private key ca.key
 
* Authority private key ca.key
−
* Diffie Hellman props dh2048.pem  !! on new distro it might be higher by default !!
+
* Diffie Hellman props dh4096.pem  !! on new distro it might be higher by default !!
 
* Server certificate server.crt
 
* Server certificate server.crt
 
* Server private key server.key
 
* Server private key server.key
Line 135: Line 179:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cd /etc/openvpn/easy-rsa/
 
cd /etc/openvpn/easy-rsa/
−
source /etc/openvpn/easy-rsa/vars
+
source vars
−
. /etc/openvpn/easy-rsa/build-key [clientName]
+
./build-key [clientName]
 
</syntaxhighlight>
 
</syntaxhighlight>
  
Line 168: Line 212:
 
<syntaxhighlight lang="bash">
 
<syntaxhighlight lang="bash">
 
cd /etc/openvpn/easy-rsa/
 
cd /etc/openvpn/easy-rsa/
−
. /etc/openvpn/easy-rsa/vars
+
source vars
−
. /etc/openvpn/easy-rsa/evoke-full [clientName]
+
./revoke-full [clientName]
 
</syntaxhighlight>
 
</syntaxhighlight>
  

Latest revision as of 22:15, 28 March 2019


Setup PKI

Setup PKI

VPN server certificate

VPN server certificate

Clients certificates

Clients certificates


OpenVPN relies on the public key infrastructure principle.

Quick reminder:


Installation

The OpenVPN package provides a set of encryption-related tools called "easy-rsa". 

apt-get install easy-rsa


Copy the Easy-RSA scripts into OpenVPN directory:

[Old Ubuntu - before 14.04] 

cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn


[New Ubuntu distro - 14.04 and later] 

cp -R /usr/share/easy-rsa/ /etc/openvpn
# You must add a symlink manually, depending on the OpenSSL version you want to use
ln -s /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf


PKI initialization

PKI Variables

Before you can generate the public key infrastructure for OpenVPN, you must configure a few variables that the easy-rsa scripts will use to generate the scripts.

These variables are set near the end of the /etc/openvpn/easy-rsa/vars file. 

vim /etc/openvpn/easy-rsa/vars


Here is an example of the relevant values: 

# 2016
# If you put '4096' it might take a very long time to generate the Diffie Hellman key (more than 30h on a raspberry pi 2)
export KEY_SIZE=2048
# Certificate owner
export KEY_COUNTRY="LU"
export KEY_PROVINCE=""
export KEY_CITY="Luxembourg"
export KEY_ORG="daxiongmao.eu"
export KEY_EMAIL="guillaume@qin-diaz.com"

>> Alter the examples to reflect your configuration.


This information will be included in certificates you create! That must be accurate, particularly the KEY_ORG and KEY_EMAIL values.

Generate Authority of Certification (AC)

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca


This an example of replies:

  • Country Name (2 letter code) [LU]: LU
  • State or Province Name (full name) []:
  • Locality Name (eg, city) [Luxembourg]: Luxembourg
  • Organization Name (eg, company) [Daxiongmao]: Daxiongmao
  • Organizational Unit Name (eg, section) [Personal_usage]: Personal_usage
  • Common Name (eg, your name or your server's hostname) [Daxiongmao CA]: Daxiongmao CA
  • Name [EasyRSA]: Daxiongmao_CA
  • Email Address [guillaume@daxiongmao.eu]: guillaume@daxiongmao.eu


Generate Diffie Hellman Parameters

The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server. 

cd /etc/openvpn/easy-rsa/
source vars
./build-dh


VPN server

Generate server certificate

First, you need to create a certificate + private key for the VPN server. 

cd /etc/openvpn/easy-rsa/
source /vars
./build-key-server [server]

→ replace server by your actual server name !


Example

  • Country Name (2 letter code) [LU]: LU
  • State or Province Name (full name) []:
  • Locality Name (eg, city) [Luxembourg]: Luxembourg
  • Organization Name (eg, company) [Daxiongmao]: Daxiongmao
  • Organizational Unit Name (eg, section) [Personal_usage]: Personal_usage
  • Common Name (eg, your name or your server's hostname) [code.daxiongmao.eu]: code.daxiongmao.eu
  • Name [EasyRSA]:VPN server code.daxiongmao.eu
  • Email Address [guillaume@daxiongmao.eu]: guillaume@daxiongmao.eu


This script will also prompt you for additional information.

  • Common Name = Name of the current server (server DNS name). Ex: dev.daxiongmao.eu


Let OpenVPN access the files

The keys and certificates for the server need to be relocated to the /etc/openvpn directory so the OpenVPN server process can access them. These files are:

  • Authority of certification ca.crt
  • Authority private key ca.key
  • Diffie Hellman props dh4096.pem  !! on new distro it might be higher by default !!
  • Server certificate server.crt
  • Server private key server.key


cd /etc/openvpn/
ln -s /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/ca.crt
ln -s /etc/openvpn/easy-rsa/keys/ca.key /etc/openvpn/ca.key
ln -s /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/dh2048.pem
ln -s /etc/openvpn/easy-rsa/keys/myServer.crt /etc/openvpn/server.crt
ln -s /etc/openvpn/easy-rsa/keys/myServer.key /etc/openvpn/server.key


!! Apart from 'ca.crt', all these files mustn't leave your server, ever!!


Client certificates

Generate Clients certificates

Now you need to generate 1 private key + 1 certificate per client. 

cd /etc/openvpn/easy-rsa/
source vars
./build-key [clientName]

Replace the [clientName] parameter with a relevant identifier for each client.

  • The client common name must be unique
  • It helps you to identify each client. Don’t hesitate to use meaningful name.


The name is put inside the certificate.

All other information can remain the same


Distribute client files

In order to authenticate to the VPN, you'll need to copy a number of certificate and key files to the remote client machines. They are:

  • Authority of certification ca.crt
  • Client certificate [clientName].crt
  • Client private key [clientName].key

!!! These keys should transferred with the utmost attention to security. Anyone who has the key is able to gain full access to your virtual private network !!!


Revoking Client Certificates

How to remove a user's access to the VPN server? 

cd /etc/openvpn/easy-rsa/
source vars
./revoke-full [clientName]


This will revoke the ability of users who have the [clientName] certificate to access the VPN.

For this reason, keeping track of which users are in possession of which certificates is crucial.

Retrieved from "http://www.daxiongmao.eu/wiki/index.php?title=VPN_certificates_management&oldid=2911"