JaredZen
Hi all,
I'm a bit new to OpenVPN 2.0 and networking in general. Been using it and its been great.
Just had a question regarding how to go about the moving the Certificate Authority. (If theres a page/guide that goes into detail about this please let me know.)
1. To move it to a new system to generate keys, do I only need to move the CA.crt and CA.Key? (I get the feeling this is a no, because I'm wondering how does the new system know what keys have been generated on the old system, in order to revoke keys and generate the crl.pem)
2. Would it work if I just installed the OpenVPN package on the new system and copy the ~/FirstVPN/ folder that contains all the keys, easy-rsa, and build scripts.
3. What would be the proper way to do this? If the answer to #2 is not the ideal way.
Some Background Info to clarify my aim:
I currently generate client-keys from an isolated ubuntu installation I have on a spare computer.
I'm thinking about moving this to a Virtualbox VM that way the system is more mobile and resilient if in the event that system dies for some reason.
Currently my ubuntu installation generates keys for 3 different VPN servers, hence in the home folder I have ~/1stVPN, ~/2ndVPN, and ~/3rdVPN each with their own set of build scripts, easy-rsa and keys folder. Whenever I would need to generate a key for a specific VPN, I would cd into the corresponding directory and run the "source vars" and "./build-key".
The 3rdVPN is my uncle's small business of 5 people and helped him out a bit by setting up OpenVPN for him to access work resources. The issue is in the future, he may need to hire an actual IT if he gets bigger and I want to be able to hand this over to the guy who comes in without giving him the the whole system containing the 1st and 2nd VPN's certificate authorities which are my personal VPNs.
maikcat
Regarding certificates....
this is all about how TLS/SSL works,a good book if you want to read is OReillys - Network Security with OpenSSL.
some things to keep in mind...
1)files need to exist in server in order openvpn to function: ca.crt,server.crt,server.key,dhXXXX.pem,ta.key(optional)
2)ca.key must NOT be left in your server
3)server does NOT keep any sort of database/catalog info of created certs,certs are recognised and they
considered valid if they are signed by your ca using your ca.key (your ca.key file IS important)
Michael.
JaredZen
Thanks for the reply.
Regarding the 3 points. Yes, I understand those points.
Maybe I using the wrong term. When I was referring to "moving the Certificate Authority", I meant moving the isolated computer that I use to build keys which gets shut off after I'm done. (The system that generates keys and the system that hosts the server are not the same)
Since my current setup is basic. All clients have their key&certificate manually created by me, and I just copy the files out with a usb.
To simplify, if the hard drive for the computer which generates the client certificate & keys had completely died.
1. What are the minimum files necessary to have backed up to continue creating valid keys and a certificate revoking list on a new clean computer?
So far my understanding is that the only things I need to keep a emergency backup copy of is the modified easy-rsa folder (~/1stVPN, ~/2ndVPN, and ~/3rdVPN)
I wanted to make sure I wasn't missing anything later on in the future in case something did happen.
maikcat
to create new keys you need:
ca.crt
ca.key
index.txt
serial.txt
i hope i didnt forget something...
Michael
