francisse
Hello dear Gurus!
I'm new here and at open VPN. I'm facing a challenge at work. People in charge of our OpenVPN are not here anymore. This thing has been working fine for years. But, I was told yesterday that our root CA cert will expire Nov. 1st. From what I understand, clients certs won't validate as soon as the root CA cert expires. Putting my company in great troubles as OVPN is the software that allow us to dump kind of blackbox devices (such as in planes) and if the dump don't work anymore, transports won't be able to leave their tracks -> Company is doomed.
So I spent most of my time reading, trying to find a solution that would allow me to:
-Recreate a new root CA cert that will continue to match clients certificates signed by the old root CA cert.
-Without any intervention, reconfiguration on the client side.
After 2 long days of trials and errors, I managed to create that new root CA cert using the original private key. My old sub-CA are validating through the newroot CA cert but I have a question for the forum:
I still need to create the intermediary CAs (clients and servers).
Will I need to deploy the new root CA cert to all clients? I mean, does this CA extension is transparent for clients?
I hope not, because that is impossible within the given period of time (15 days remaining).
I need to know because I nee to tell my boss if my solution will do, or not.
I'm not familiar with openVPN and have been working on it for only 2 days so please, be abundant in your explanations 🙂
Many thanks in advance !
