You _must_ run clean-all.bat, or do it by hand.
NOTE TO THE DEV TEAM: Putting this in init-config.bat is much more intuitive! We don't expect to need to clean up if we're starting from scratch!
md keys
md vars
copy index.txt.start keys\index.txt
copy serial.start keys\serial
And you need to run
build-ca.bat
before you can build the server or the client keys.
Please also be certain to edit vars.bat to change default keys size and so on first - 1024 is not appropriate for production, 2048 is for normal use, or 4096 for paranoid use.
FYI - look at readme.txt - on the 2.3.0 I004 Windows version, it says:
Extract all zip'd files to the OpenVPN home directory,
including the openssl.cnf file from the top-level
"easy-rsa" directory.
First run init-config.bat
Next, edit vars.bat to adapt it to your environment, and
create the directory that will hold your key files.
To generate TLS keys:
Create new empty index and serial files (once only)
1. vars
2. clean-all
Build a CA key (once only)
1. vars
2. build-ca
Build a DH file (for server side, once only)
1. vars
2. build-dh
Build a private key/certficate for the openvpn server
1. vars
2. build-key-server <machine-name>
Build key files in PEM format (for each client machine)
1. vars
2. build-key <machine-name>
(use <machine name> for specific name within script)
or
Build key files in PKCS #12 format (for each client machine)
1. vars
2. build-key-pkcs12 <machine-name>
(use <machine name> for specific name within script)
To revoke a TLS certificate and generate a CRL file:
1. vars
2. revoke-full <machine-name>
3. verify last line of output confirms revokation
4. copy crl.pem to server directory and ensure config file uses "crl-verify <crl filename>"
