I'm really new at this, and I'm not a tech. However, I have a little experience in security from previous Federal gov't (secure comms) and military (CAC/SmartCard). I'm now using PKI for my corporate comms and OpenVPN. There is a really handy guide to creating the CA, CRT, and KEY files available here:
https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide.
In a nutshell (I'm using Windows), I open cmd, cd to the installation directory /easy-rsa, and do the following:
First, I start with clean-all to ensure a clean build
Then, I open my vars.bat with: notepad vars.bat
I edit the sample info with my company info, and save the file
Then, I run "vars" as a command
Now, I build the CA and the keys
Type build-ca
That will start building the certificate auth.
Once you're done, you'll build the server cert and key with build-key-server server
(notice server is in there twice. My understanding is that this builds a special
server key that clients can auth against, rather than just a build-key)
After entering all the info, you'll want to build a client key with build-key client*
*you can rename the client here to anything you want
After you've built the client key, generate your duffie hellman params with build-dh
If you're using Windows, your keys are now at installation directory\easy-rsa\Keys
Move them to a smart card, or a thumb-drive (if you want), edit your config to point to wherever you moved them, and have fun!
-Chris
