So I used Ansible to configure my OpenVPN server. I have a vars file that has the passphrase for the CA cert, the server cert and myuser (note: this file is encrypted with ansible vault).
I then configured my client machine and tried to use myuser passphrase, but it didn't work. The ca passphrase worked however and I'm not sure why.
server.conf:
port 1194
proto udp
dev tun
ca pki/ca.crt
cert pki/issued/server.crt
key pki/private/server.key # This file should be kept secret
dh pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
client.conf
client
tls-client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/pki/myuser.crt
key /home/myuser/openvpn/pki/myuser.key
remote-cert-tls server
tls-auth /home/myuser/openvpn/ta.key 1
comp-lzo
verb 5
Here is my Ansible playbook with the portion of the passphrases. I'm using the expect module to answer the prompts that go with configuring the openvpn server. The
responses: are just looking for a string to match to answer with. I don't expect you guys to know Ansible, but the variables are in '{{
some_variable }}' You can see how they are defined. When i launch my client, I end up using '{{ ca_cert_passphrase }}'
command to run openvpn client
sudo openvpn --config ~/openvpn/client.conf
Ansible playbook sample
- name: GENERATE CA CERTIFICATE AND KEY
expect:
command: /home/ubuntu/easy-rsa/easyrsa3/easyrsa build-ca
chdir: /home/ubuntu/easy-rsa/easyrsa3
responses:
Enter: '{{ ca_cert_passphrase }}'
Verifying: '{{ ca_cert_passphrase }}'
Common: '{{ ca_cert_common_name }}'
- name: GENERATE SERVER CERTIFICATE AND KEY
expect:
command: /home/ubuntu/easy-rsa/easyrsa3/easyrsa build-server-full server
chdir: /home/ubuntu/easy-rsa/easyrsa3
responses:
Enter: '{{ server_cert_passphrase }}'
Verifying: '{{ server_cert_passphrase }}'
key: '{{ ca_cert_passphrase }}'
- name: GENERATE CLIENT CERTIFICATE AND KEY
expect:
chdir: /home/ubuntu/easy-rsa/easyrsa3
command: /home/ubuntu/easy-rsa/easyrsa3/easyrsa build-client-full myuser
responses:
Enter: '{{ myuser_cert_passphrase }}'
Verifying: '{{ myuser_cert_passphrase }}'
key: '{{ ca_cert_passphrase }}'
