Remove password from key files?

shmn

I'm new to OpenVPN and am following a couple of guides (guide1 guide2) but have a question regarding the step of removing the password from the client and server key files:

openssl rsa -in /config/auth/host.key -out /config/auth/host-decrypted.key
openssl rsa -in /config/auth/client1.key -out /config/auth/client1-decrypted.key

I'm installing the VPN server on an Edge Router X and the client will be an Android phone running OpenVPN app. When I try to connect to the server through the app I want to require a password to be entered.

Do I skip the step above or is it still required?

I'm not sure I understand the reason for decrypting the keys. I read through the OpenVPN How-To but it doesn't mention this step. Thanks.

TinCanTech

shmn wrote I'm not sure I understand the reason for decrypting the keys

If a key is encrypted then you need a password to decrypt the key in order to use it.

shmn wrote When I try to connect to the server through the app I want to require a password to be entered.

This is a completely different password used to authenticate your client when connecting to the VPN.

shmn

After trying different configurations, this is what I've learned:

1. You do want to decrypt the key that will go on the server (host key) otherwise the server will throw an error or keep asking for the password.
2. You can decrypt the key for the client if you don't want to enter a password at the client end.
3. I did not decrypt the key for the client going on my phone because I want the OpenVPN app to ask for a password every time I want to connect.
4. So the PEM passphrase you enter when building a certificate will be the password you use in the OpenVPN app to connect.