New here, certificates question

GRIFFCOMM

Hi, i am not new to VPN, i am however new to openVPN, i have played with the Windows PC server and a QNAP NAS running QVPN server both running as openVPN servers, however my question is this.

I have an appliance (phone) that supports openVPN, but is asking for 3 certificates, how do i get these certificates from the Windows Server or QNAP appliance running openVPN? (the openVPN system only seems to download 1 certificate)

Cetificates needed are:
- OpenVPN® CA
- OpenVPN® certificate
- OpenVPN® Client Key

Image of the client device asking for them:

Sop_1000

You need to painfully generate them following this painful guide, keep in mind your certs won't be valid for a few hours after you generate them.

https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide

GRIFFCOMM

Hi Thanks..... i have the manufacture looking at this as well, they seem to be saying the username / password should work, i am not sure it does, so they are working on it as well.

Sop_1000

CA should be the same as the server, CRT and KEY are client specific and should be generated from openvpn server installation, also, that client doesn't ask for a ta.key, which I think is needed for TLS, so you should probably disable that on the server, somehow. Also make sure the cipher method matches the server, AES-256 is the standard. Not sure about username, windows client never asks user input on that, just the password, and the password is "stamped" on the client certificate.

GRIFFCOMM

Thanks, i have a new firewall (Watchguard) appearing in about a week, i will be investigating this a lot more than, they support openVPN also, ive not looked at it since first trying all this. The Windows PCs work fine, its this device (phone) thats creating an issue.

Sop_1000

Oh no, I hate Watchguard, mainly because of the licensing thing, you can't basicly have a proper firewall without 10 licences one for each thing, you're gonna have to get a VPN license for that to work. I might not be 100% correct on this though.

GRIFFCOMM

We are a watchguard reseller, you dont need licenses, the firewall is free, to be warrantied you need "license", however the VPN is free on them (up to a certain amount).

They do however have "services" you pay for which we never sell, when the "license" for the unit expires it continues to work as a firewall WITH the built in VPN it came with, you cant however upgrade the firmware once the support stops. It will work indefinitely as a firewall with the base VPN (SSL / site to site etc...), sure you want LOADS of SSL and site to site then you need to pay for it...