I'd like to use the keys/certificates generated by the
EFF's new(ish) service letsencrypt rather than the easy-rsa tool. What I want to achieve is: (1) Keep the number of keys I have to maintain and key-generation tools I have to manage to a minimum, and (2) avoid having to deal with warnings or exceptions to accommodate the use of self-signed keys.
Because my understanding of cryptography is limited, I'd like to ask a couple questions, namely: (A) Is this type of approach reasonable? It seems to me that both methods generate public and private keys, and so I'd expect them to be interchangeable, but I'm open to being completely wrong. (B) How do I go about doing this? Can I just substitute my .pem files for the .crt files used in the openvpn instructions?
What I'm imagining is having letsencrypt generate a trusted certificate for e.g. vpn.mydomain.com that I can use instead of the master certificate authority, another one for server.mydomain.com that I can use for the server's keypair, and so on with client1.mydomain.com, etc. Assuming this is reasonable, how do I adapt the other steps like the Diffie-Helman generation parameters?
Any insights would be appreciated, thanks!
