clearnetedm
Hey folks I'm sure this has been asked and answered but I can't find it. Lots of support that overlaps the various versions of OpenVPN. Anyways pretty new but have a OpenVPN-AS setup and working great. However I've been asked to increase the RSA key to 4096. I can do this ok for the web server but can't for the VPN side, if that makes sense.
these are the ones I'm after:
@openvpn:/usr/local/openvpn_as/scripts$ sudo ./sa dump
License Info {'concurrent_connections': 10}
<Cert(cn=u'OpenVPN CA' sn=rev=False al=False un=None t=u'ca' nsn=9 ks=2048 cmt=None crt=u'-----BEGIN CERTIFICATE--...' pk=u'-----BEGIN PRIVATE KEY--...')>
<Cert(cn=u'OpenVPN Server' sn=1 rev=False al=False un=None t=u'server' nsn=None ks=None cmt=None crt=u'-----BEGIN CERTIFICATE--...' pk=u'-----BEGIN PRIVATE KEY--...')>
<Cert(cn=u'TLS Auth' sn=None rev=False al=False un=None t=u'tls_auth' nsn=None ks=None cmt=None crt=None pk=u'#\n# 2048 bit OpenVPN sta...')>
<Cert(cn=u'DH Parms 2048' sn=None rev=False al=False un=None t=u'dh' nsn=None ks=2048 cmt=None crt=u'-----BEGIN DH PARAMETERS...' pk=None)>
clearnetedm
Well thanks for the fantastic support team they provided me this, and it work great. Keep in mind you will have to re-issue your client certs so is user impacting.
Hello,
The default size of the keys generated in the Access Server is currently set to 2048, yes. Options are 1024, 2048, 3072, and 4096. To change it you need to use this command. But beware; this setting will replace the old server key with a new one, and that means that all the client certificates are immediately invalid, and they will all be revoked and will be replaced with new ones once users log in. In some cases this could mean you have to reinstall your clients.
# cd /usr/local/openvpn_as/scripts/
# ./sa --keysize=4096 Init
(that's a capital i in the word init).
Kind regards,
OpenVPN Technologies, Inc.
