Hi all,
Final goal: use XCA to create and manage CAs, including an intermediate CA for OpenVPN, and client and server certs for OpenVPN.
This didn't work - got on client:
VERIFY ERROR: depth=1, error=unsupported certificate purpose: /C=**/ST=**/L=**/O=**/OU=**/CN=**SubCA/emailAddress=*****
Decided to try out intermediate CA config on a test Debian unstable machine.
Ended up with this - hope this is the correct way to do this; comments welcome
OpenVPN intermediate CA creation on a Debian host
Note:
- openvpn 2048 bit keys or 1024, not more
- for 2048, generate dh2048.pem; for 1024... dh1024.pem
aptitude install openvpn
#Openvpn troubleshooting server config:
/etc/openpvn/openvpnintermediate.conf
mode server
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/intercakeys/ca.crt
cert /etc/openvpn/easy-rsa/intercakeys/openvpnserver.crt
key /etc/openvpn/easy-rsa/intercakeys/openvpnserver.key
# Diffie-Hellman use 1024 bit for 1024 bit keys; 2048 for 2048 bit
dh /etc/openvpn/easy-rsa/intercakeys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 7
mute 20
# copy default easy-rsa scripts (version 2):
mkdir /etc/openvpn/easy-rsa
cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa
#find out which openssl we have:
openssl version
#gives OpenSSL 1.0.0g 18 Jan 2012
nano vars
#Set KEY_CONFIG to point to the correct openssl-<version>.cnf:
export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf
#Set KEY_DIR to point to a directory which will contain all keys, certificates, etc
# for the root ca (not intermediate ca or servers/clients):
export KEY_DIR="$EASY_RSA/root_ca_keys"
#KEY_SIZE to 2048 - optional, but I'm paranoid ;) :
export KEY_SIZE=2048
#fields suitable for intermediate ca:
export KEY_CN=interca
export KEY_NAME=interca
export KEY_OU=host.domain_ca_division
#now copy vars for intermediate ca
cp vars inter_ca_vars
#... and edit them for use for endpoints (clients/servers):
nano inter_ca_vars
#edit place where keys are stored
# intermediate ca has separate key directory
export KEY_DIR="$EASY_RSA/intercakeys"
#edit to set up end user certs
export KEY_CN=EndPoint
export KEY_NAME=EndPoint
export KEY_OU=host.domain_endpoint_division
# set up root ca:
source ./vars
# clean-all may actually be necessary to create index.txt etc...
./clean-all
#initialize root ca; give it a cert with cn=rootca
KEY_CN=rootca
KEY_NAME=rootca
./pkitool --initca rootca
#generates these files in keys/: ca.key, ca.crt, index.txt, serial
#build intermediate ca, with name interca
KEY_CN=interca
KEY_NAME=interca
./pkitool --inter interca
# generates these files in keys/:
# interca.crt, interca.key, and more
# interca cert is SHA1 with RSA encryption has
# authorityKeyIdentifier=keyid, issuer
# subjectKeyIdentifier=hash
# in XCA, subject has an additional property type name, content interca (probably maps to KEY_NAME)
# also in XCA certification authority (obvioulsy), Subject Key Identifier and Authority Key Identifier
# now set up intermediate ca as our openvpn signing ca:
# more or less the same process as ./pkitool --initca
# change vars to our intermediate ca keys directory
source ./inter_ca_vars
# clean up, just in case
./clean-all
# ... this will, strangely enough, generate index.txt and serial
# in the intercakeys directory... and we need these later
# build diffie-hellman parameters in intercakeys directory
./build-dh
# generates /etc/openvpn/easy-rsa/intercakeys/dh2048.pem
# Set up the intermediate ca using the key and cert signed by
# root ca in their key dir
./inherit-inter /etc/openvpn/easy-rsa/root_ca_keys interca
# generates several files in /etc/openvpn/easy-rsa/intercakeys:
# export-ca.crt
# a concatenated/chained ca file with
# the root and intermediate ca after each other.
# this is needed for your openvpn config
# ca.crt
# this is the intermediate cert only, for easy-rsa usage only
# ca.key
# the key for that intermediate ca crt, also easy-rsa use only.
#now generate server, client certs using our intermediate ca
# note: make sure you change the Name (CN is changed for you when specifying a name)
# otherwise you get
# failed to update database
# TXT_DB error number 2
# on adding the second cert
KEY_CN=openvpnserver
KEY_NAME=openvpnserver
./pkitool --server openvpnserver
# gives cert; extensions:
# keyUsage=digitalSignature, keyEncipherment
# extendedKeyUsage=serverAuth
# authorityKeyIdentifier=keyid, issuer
# subjectKeyIdentifier=hash
# nsComment=Easy-RSA Generated Server Certificate
# nsCertType=server
# basicConstraints=CA:FALSE
# imported in XCA gives:
# subject has an additional property type name, content openvpnclient (probably maps to KEY_NAME)
# extensions End Entity, Subject Key Identifier and Authority Key Identifier
# Key usage: Digital Signature, Key Encipherment
# Extended Key Usage: TLS Web Client Authentication
# Netscape: SSL Server
# Netscape: comment: Easy-RSA Generated Certificate
KEY_CN=openvpnclient
KEY_NAME=openvpnclient
./pkitool openvpnclient
# gives cert; extensions:
# keyUsage=digitalSignature
# extendedKeyUsage=clientAuth
# authorityKeyIdentifier=keyid, issuer
# subjectKeyIdentifier=hash
# nsComment=Easy-RSA Generated Certificate
# basicConstraints=CA:FALSE
# imported in XCA gives:
# subject has an additional property type name, content openvpnclient (probably maps to KEY_NAME)
# extensions End Entity, Subject Key Identifier and Authority Key Identifier
# Key usage: Digital Signature
# Extended Key Usage: TLS Web Client Authentication
# Netscape tab: ??nothing?? would expect SSL Client
# comment: Easy-RSA Generated Certificate
# return KEY_NAME to previous value
source ./inter_ca_vars
