So I setup OVPN and got a test connection to work. However, my understanding was that the passphrase entered would be the client's crt/key and
NOT the ca.key. I plan on having multiple users with their own client cert/key to connect to the VPN but I don't want them to use the CA.Key passphrase. When I run
sudo openvpn client.conf
- it's asking for the CA_PASSPHRASE
I used these commands to generate all the certs/keys:
./easyrsa init-pki
./easyrsa build-ca
> entered in CA_PASSPHRASE
> verified CA_PASSPHRASE
> entered COMMON_NAME
./easyrsa build-server-full server
> entered in SERVER_PASSPHRASE
> verified SERVER_PASSPHRASE
> entered in CA_PASSPHRASE
./easyrsa build-client-full client
> entered in CLIENT_PASSPHRASE
> verified CLIENT_PASSPHRASE
> entered in CA_PASSPHRASE
My configs:
server.conf:
port 1194
proto udp
dev tun
ca pki/ca.crt
cert pki/issued/server.crt
key pki/private/server.key # This file should be kept secret
dh pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "route 10.x.x.x 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
client.conf
client
tls-client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/pki/myuser.crt
key /home/myuser/openvpn/pki/myuser.key
remote-cert-tls server
tls-auth /home/myuser/openvpn/ta.key 1
comp-lzo
verb 5
