Hello, I answer this old thread to give the method I followed to do the migration, as here is were I ended when I looked for some info on how to migrate.
I just tried it on my server and everything seems to work fine (I replaced my former client certificate with a new generated one without touching the server conf and it worked).
So here are the steps:
- be sure to have installed easyrsa 3 🙂
- create a new my_ca folder
# as root
$ cd /home/openvpn/my_ca
$ cd ..
$ mv my_ca my_ca_v2
$ make-cadir my_ca_v3
- instanciate the v3 files normally to see where should go the files
# as root
$ cd /home/openvpn/my_ca_v3
$ vi vars
# copy the values from my_ca_v2/vars needed, like your organisation description
$ ./easyrsa init-pki
$ ./easyrsa build-ca
$ ./easyrsa gen-dh
$ ./easyrsa build-server-full dummy_server
$ find .
- copy all generated files from my_ca_v2
# as root
$ cd /home/openvpn/my_ca_v3/pki
$ old=/home/openvpn/my_ca_v2/keys
$ cp $old/*crt ./issued/
$ cp $old/*key ./private/
$ cp $old/ca.crt ./ca.crt
$ cp $old/*csr ./reqs/
$ cp $old/??.pem certs_by_serial/
# all my pem files were following a 01 02 03 serie
$ cp $old/dh2048.pem ./dh.pem
$ cp $old/index.txt ./index.txt
- generate new client certificate
# as root
$ cd /home/openvpn/my_ca_v3
$ ./easyrsa build-client-full jai_2 nopass
$ cd pki
$ mkdir -p /tmp/jai_2/
$ cp ./issued/jai_2.crt ./private/jai_2.key ./reqs/jai_2.req /tmp/jai_2/
# then normal scp and configuration of my client
