armbp1972
Hi:
I've recently setup a system that use openvpn to authenticate user connections to two servers. Each of these have their own administration personnel, which will deal with the generation of TLS certificates and keys for the users that connects with their servers. In a secure windows machine that belongs to the infrastructure of the server number 1 I created a mechanism based in the "TLS certificate managements scripts" that came with openvpn to generate the certificates for the users of that server. Now I'm setting up the second server, and my idea was to copy the CA certificates, keys, index, etc. from the first server to the "easy-rsa" folder of the windows machine that is going to play the same role in the second server, in order to allow both administration to generate certificates compatibles with both server. The reason to do this was to have redundancy in the use of the servers, I mean with this: if one of the servers falls, the clients of that server could continue receiving service from the other server based in the fact that both servers have the same CA authority, even when that's not really true, because the generation of certificates takes places in two different machines.
When I did that, it didn't works. When I tried to connect from a client with a certificate generated in the second server (even when the CA certificate, key, etc. was copied from the first server) to the first server in the process of tls negotiation apparently the client machine accepts the data coming from the server (which makes sense because the CA certificate that user use haven't change at all), but the server do not accept the certificate that the client machine is sending (this one was generated in a different machine that the CA and server certificate). I did other similar test, this time coping the whole Openvpn folder from the first server to the second, and the results were the same.
That, in certain way, makes sense too (even when I would like that it not), and I could deal with it, establishing a mechanism in which there will be only one administration that deals with the generation of all certificates, and the other ask for certificates when they needed one. But that problem makes me thinks on another: ¿If the generation of the certificates is so "machine depending", what would happens if the certificate generating machine get broken and I have to rebuild it in other hardware? ¿If I have a clone of the hard disk that will be sufficient?
Mimiko
In order to have the client to connect to other server with same certificate, then main server certificate and master key must be same on both servers. Of course you can generate certificates on different systems, as long as keeping server certificate equal.
armbp1972
Of course, that's true: the certificate and key of the server must be the same but the clients certificates must be certificated by the same CA that generate the server certificate, no?
So, if that's so how, how could I generate two certificates in different machines using the same CA key in both? That's the problem, when I generated the keys in the first server that was ok, because there was when I generated the CA certificate and key. But when I copied the OpenVPN folder to the second server, where I want to establish the second CA authority (like a replica of the first), I can not connect to ether server with the generated client certificate and key.
Mimiko
Probably you didn't copy all certificate database files: *crt, *.key files of the server, crl.pem, index.txt, index.txt.attr, serial and dh1024.pem under the "keys" subdirectory. Check them out.
