Setting up OpenVPN / Easy-RSA question

brad1ey

I am on Windows 10. I have downloaded the openvpn installer and understand that easy-rsa is NOT included in 2.3.8. I know where to get the zip file. I have read the instructions for using easy-rsa, but I am confused.

1. Why is there an easy-rsa folder in c:\program files\openvpn after install if it is not included in 2.3.8? Can I just build-ca, server, etc. from the easy-rsa folder in my installation or do I need to get the easy-rsa-3.0.0.zip file and try use it?

2. If I need to get the easy-rsa-3.0.0.zip file and use it, can anyone point me to the STEP BY STEP instructions for using it? The several help files in the .zip are very confusing and I do not even know how to start.

I apologize for such noobish questions. I have read and read about easy-rsa and have a decent amount of configuration experience (e.g. configuring and using public/private keys for OpenSSH), but I cannot figure out how to use easy-rsa in 2.3.8 or whether I even need to use it given that I am able to create ca.crt, server.crt, server.key, and client.crt, etc. using vars in the easy-rsa folder which was created in the original installation. Your help will be much appreciated.

jamesnb

I have exactly the same issue like yours. But I go ahead and use stuff in the included "easy-rsa" folder to create ca.crt, server.crt, server.key, client1, etc... and apparently (like I suspected) it did not work. When I try to establish the VPN connection, it gives me a "connection reset by peer" Not sure it is because of this outdated (but included) easy-rsa or because I have wrong configuration (which I will create another thread for it).

I have downloaded the latest RSA, version 3.0.0 from this forum but do not know how to use it. Apparently, when unzip the downloaded v3, it does not content any of the *.bat file such as init-config.bat, vars.bat, etc... to start with like the included easy-rsa above. So, I am pulling my hairs off now...

But yeah, give it a shot and post back the results (whatever you can find)

jamesnb

Traffic

The easy-rsa-v3.0.0 found here is not complete:
https://github.com/OpenVPN/easy-rsa/releases

You can download version v3.0.0-rc2 for the complete version.

The maintainer is aware, we are awaiting resolution.

brad1ey

I was able to create certificates as instructed using the existing easy-rsa folder and have openvpn on the dd-wrt router working. I have 2 different clients that connect and do what I want them to do. Since this is working, I am assuming all is well, but Traffic's response leads me to these questions...

Is there a security issue here?

I am I not getting something such as perfect forward secrecy (for example) because I created my certificates using the existing easy-rsa directory?

In short, what am I missing by not using the easy-rsa which is not included in 2.3.x?

brad1ey

It seems as if my reply did not post, so I will try again.

I do not understand why 2.3.x does not contain easy-rsa, yet it seemingly does.

I have successfully created certificates using the built in files in the easy-rsa directory in 2.3.8. I have 2 clients that are working fine with the openvpn installation in my dd-wrt router.

I am still wondering about the following...

1. Is there a security issue because I am using the built in easy-rsa?

2. Am I missing some aspect of openvpn, such as perfect forward secrecy for example, since I am using built-in easy-rsa?

3. In short, what am I missing by using the built in easy-rsa?

Traffic

brad1ey wroteIt seems as if my reply did not post, so I will try again

We have had moderation problems ..

brad1ey wroteI do not understand why 2.3.x does not contain easy-rsa, yet it seemingly does

The windows installer still includes easy-rsa if you select it. See this post for the future .. https://forums.openvpn.net/topic19629.html

brad1ey wroteI have successfully created certificates

You should be fine if you use dh 2048bit or more.. For now ..

Of course nobody can really predict the future ..
Maybe quantum computers are not just the fevered dream of a madman .. in which case we are all screwed anyway :ugeek: