Where to put certs?

dummkauf

I'm new to OpenVPN and am playing around with it on Amazon AWS with Access Server on an EC2 instance.

I have the VPN working using password authentication, but I would like to try setting up certs to authenticate the clients. I generated the certs using easy-rsa v3.0.5 following this guide: https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto, but it doesn't tell me what to do with the certs once they've been generated and signed.

I also looked at the how-to located here: https://openvpn.net/index.php/open-source/documentation/howto.html#pki. However at the end of the PKI section it just says to "The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel.", but doesn't tell you where on the server to copy the files to. I'm assuming the certs need to be added to a specific directory or referenced in the configuration somewhere, but I can't seem to find where this is documented.

Where do the certs go once they've been created and signed?

The Johan

OpenVPN Access Server already uses certificates, but it's fully automated. They're embedded in the client.ovpn files that it automatically creates for you. If you want to force users to come to you to get the required files you could consider disabling web interface access and doing things manually, but there are some downsides to that. See this document:
https://docs.openvpn.net/getting-started/recommendations-to-improve-security-after-installation/#Going_beyond_recommended_security_procedures

dummkauf

ahh, that makes sense. However, how do I confirm what type of key it's using and or change it if I wanted to?

The Johan

Well, if you want to get the technical details of the key, you can cut it out of the client.ovpn file and run it through openssl to see what type of key it is and such.

If you want to change the key, easiest way is to go to the admin ui of the access server, go to revoke certificates, and kill the certificate/key for this particular user. The access server will generate a new one when it becomes necessary.