help on how to redo client and server certificates

Alanmit

I set up a OpenVPN server a few years ago and had it up and running smoothly with around 10-15 clients. No problems with the set up whatsoever. One day I went to make a new key for a new client, and mistakenly did a ./clean-all
Now this cleared all the keys that were saved on the /openvpn/easy-rsa/keys folder. I thought that I would have to rebuild all the keys, client and server, but found that even after the ./clean-all, all the clients were still able to successfully connect. So I ignored it and moved on and created a new client key as usual. However, using this key did not work (authentication errors). I then tried to create a new ca.crt and ca.key, but new keys still do not work, but the old ones still do. The only ca.key file I can find on the server is in the /openvpn/easy-rsa/keys folder, and the old one has been permanently lost. It confuses me why the old keys would still work then, since I have no more client.key files (to my knowledge), nor the right ca.crt for the ca.key on the server. The new ca.crt generated does not work for the clients. I have not changed the server.key/crt/csr

At this point I'm stuck with the old client keys working, but I can't add anymore new clients. I need to be able to rebuild the whole key/certificate infrastructure, or somehow get newly generated client keys working.

port 1194
proto tcp
dev tap0
ca ca.crt
cert ####.crt
key ####.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.2.21 255.255.255.0 192.168.2.100 192.168.2.199
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Alanmit

I have restarted the server several times. This actually happened a few months ago and I've left the server running as is.

I wouldn't mind redoing the PKI from scratch to get a clean start, but that's how I got into this problem to begin with, by accidentally running

source ./vars
./clean-all

It did not invalidate the old keys or certificate, and the new ones don't work (even after restarting the server).

Alanmit

Maybe giving some more details about what files I have would help troubleshoot?
I have an old set of files (from 2012) and newly generated files (from 2014).

In the /etc/openvpn directory, I have a ca.crt (old, I think I just copied as a backup), an ipp.txt (old, with all the names and ip of the old set of certificate keys I had), server.conf, the server.crt/csr/key (all old), dh1024.pem (old), along with some other default script and log.

In the /etc/openvpn/easy-rsa directory, there's all the default scripts, the openssl.cnf, and vars.

In the /etc/openvpn/easy-rsa/keys directory, there are 2 client.keys/csr/cst that I tried making after the accidental ./clean-all. Also there is a ca.crt and ca.key (new).

Alanmit

So does it mean it's kind of inexplicable why my old client keys work even after a clean-all? Or do the valid signed keys go through some other authentication outside of the openvpn/easy-rsa/keys folder and I would have to revoke them all individually?

What would you say is the proper way to start over? The new client keys I generate AFTER doing a

source ./vars
./clean-all
./build-ca

don't work. I tried with both the new and old copy of the ca.crt on the client side. The ones I made before that do, with the old ca.crt on the client side (the new ca.crt doesn't work).

Thanks for taking the time to answer my questions.

Alanmit

I completely rebuilt all the keys from scratch and now the old keys no longer work and the new ones do. I still don't know why removing keys from the key directory doesn't invalidate them, but I'm happy everything is working now and I can make new working keys.

Thanks for all the help, debbie10t.