Reproduce server configuration from client profile

openvpnnewb

I set up an OpenVPN server about a year ago and made some client ovpn profiles which were installed on several remote devices which periodically automatically connect to the server. The server has recently gone down and all of its configuration files are lost.

Is it possible to install a new OpenVPN server so that the clients connect to it without having to change the ovpn profiles?
Presumably I would need to change the certificate of the server. If I just go in and manually change /etc/openvpn/easy-rsa/pki/ca.cert will this cause any conflicts etc.? What other config files would I need to change to make this work? Do the ovpn profile files have all the information I need to reproduce a working server?

The ovpn files start with configuration lines (including verify-x509-name setting), then there are two certificates (presumably one for the server and one for the client?), one private key and an 'Open VPN Static key V1'.

I know this is probably not how you're supposed to do things, but it would save me a lot of trouble if I didn't have to change all the clients manually.

I don't care about security, I am happy to disable verification checks and the like. I just need them to connect one time then I can remotely change the client profiles.

TinCanTech

openvpnnewb wrote If I just go in and manually change /etc/openvpn/easy-rsa/pki/ca.cert will this cause any conflicts etc.?

If it did not cause conflicts then there would not be much 'P' in VPN.

openvpnnewb

TinCanTech wrote If it did not cause conflicts then there would not be much 'P' in VPN.

So are you saying it's not possible?
What would the conflict be? Is the server certificate saved in multiple places? Can I just update all of these files?
Or is there a private key on the old server that I am going to need a copy of?
What precisely is stopping me from recreating the server?
Again, I'm not talking about best practices here, this is literally a one-off hack.

Many thanks for the reply.

openvpnnewb

My understanding is that if the client profile has the line

[oconf=]remote-cert-tls server[/oconf]

in its ovpn profile file, then a MITM attack is not possible. Is this correct?
If it doesn't have this line, is it possible to impersonate my old server?

TinCanTech

openvpnnewb wrote The server has recently gone down and all of its configuration files are lost

The config files are not important.

However, the CA Certificate and private key are crucial as is the server Certificate and private key.

You cannot create a new server cert/key without the CA cert/key.

So you need a new PKI and that means you will have to issue new cert/keys to all your clients as well.

Next time, keep a backup.

openvpnnewb

This was as I feared.
Just for the sake of clarification though, are there any scenarios where a client, depending on its setup, would be able to connect to a different server? For example if its .ovpn profile were missing the 'remote-cert-tls server' line and perhaps some other lines?