Automatize certificate creation (removing all user actions)

woop

Hi,

I assume this question was already asked, but I haven't been able to find any topic yet ..

So here is what I'm trying to do.

I basically want to create a certificate for OpenVPN, but fully automatize this process. Right now, people log in to a webportal and generate their cert. It works, but I now want to integrate a passphrase.

Here is my script

exec("export EASY_RSA='/etc/openvpn/easy-rsa';
export OPENSSL=openssl;
export PKCS11TOOL=pkcs11-tool;
export GREP=grep;
export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl.cnf;
export KEY_DIR=/etc/openvpn/easy-rsa/keys;
export PKCS11_MODULE_PATH=dummy;
export PKCS11_PIN=dummy;
export KEY_SIZE=1024;
export CA_EXPIRE=3650;
export KEY_EXPIRE=3650;
export KEY_COUNTRY=$_POST['C'];
export KEY_PROVINCE=$_POST['ST'];
export KEY_CITY=$_POST['C'];
export KEY_ORG=$_POST['CO'];
export KEY_EMAIL=$_POST['CN'];
export KEY_CN=xxxx;
export KEY_NAME=xx;
export KEY_OU=xxxx;
export PKCS11_MODULE_PATH=changeme;
export PKCS11_PIN=1234;
/etc/openvpn/easy-rsa/build-key $CN")

When I execute my script (php), here is what I get

Generating a 1024 bit RSA private key
...............................++++++
.............++++++
writing new private key to 'mykey.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:problems making Certificate Request

So my exports are working fine [US], but my script got killed because it's waiting for an user input (press Enter..)

I wondering if there is a way to automatically force the certificate to be created with the default values I've passed with my $_POST?

As an addition, how can I specify a password automatically suing ./build-req-pass ?

Thanks 🙂

woop

Ok so I found a great topic here : https://forums.openvpn.net/topic7620.html

I've removed the --interact flag on my script and looks like my certificate is generated ...
However, I now have a different problem

Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
wrong number of fields on line 27 (looking for field 6, got 5, '' left)

26 [ ca ]
27 default_ca = CA_default # The default ca section

Not sure what's wrong.

Also, still trying to figure out how to pass passprhase argument with ./build-req-pass..

🙂

** EDIT ** My bad, my index.txt was misconfigured 🙂. So now I only need to figure out how to pass a password as argument using build-req-pass 🙂

janjust

if you're building PHP scripts around the 'build-key-pass' or 'build-req-pass' bash scripts then you're making this quite inefficient; it would be better to dig into what 'build-key-pass' does:

openssl req .....
openssl ca .....

(the arguments to both openssl commands are too lengthy to explain here).

The other thing to try is to modify the 'pkitool' script and to add a '-passin pass:PASSWORD' parameter to the 'openssl req' command.

woop

Janjust,

Executing openssl command was my first option my script is working well. However, I'm not able to generate a private key protected by passphrase. I tried several method without success.

1 - create passphrase protected key
2 - create csr based on my key
3 - execute pkitool --sign mycsr

This method works well but my pkitool is regenerating a private key w/o passphrase.

Then I tried to follow this guide, https://forums.openvpn.net/topic10261.html , instead of signing automatically my csr, I do that manually and then execute the script to insert my certificate to index.txt. Not sure why but my certificate is not recognized when I try to connect.

That's why I moved to this 3rd solutions, and looks to be the easier to implement since, as soon as you pass all arguments, everything is managed by easy-rsa.

However I'll start to tweak the pkitool function called by build-req-pass.

woop

Finally using openssl command instead of openssl scripts. Works perfectly