Motivation I like to experiment with a VPN server and I like to experiment with ECC. The later is just for fun.
I followed
http://www.gagliardoni.net/ 's instructions titled "(Mar 17th, 2013) HowTo: OpenVPN with Elliptic Curve Cryptography (ECC) and SHA2 on Linux Debian". I run stock 16.04 Ubuntu on my RPI2 and have skipped the patches, assuming my versions included those:
- OpenSSL 1.0.2g-fips 1 Mar 2016, LZO 2.08
OpenVPN 2.3.10 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016
One of the of the problems I had was that /root/.ssl didn't exist. Instead I started off in /usr/lib/ssl, placing e.g. req.pem, cacert.pem, and folder server there.
I reduced the DH modulus' size to 2048 (instead of 4096).
I happily used openssl.cnf in /usr/lib/ssl until ...
... the following instruction caused an error:
openssl req -new -key private/serverkey.pem -config ../openssl.cnf -extensions server -days 36500 -sha512 -out req.pem
The error suggested a problem in the server section of the cnf file? Switching to /usr/share/doc/openvpn/examples/sample-keys/openssl.cnf at this point helped me move along.
However, I came to a standstill here:
openssl ca -config /usr/share/doc/openvpn/examples/sample-keys/openssl.cnf -extensions server -policy policy_anything -out server/servercert.pem -md sha512 -cert cacert.pem -keyfile private/cakey.pem -infiles req.pem
due to error
sample-ca: No such file or directory
After installation of openvpn, should I have performed some instruction to create sample-ca?
