Hi I configured my own Vpn Server on Ubuntu 20.04 LTS. OpenVpn Server version is 2.4.7 Easy-rsa version is 3.0.4 i created a user cert below [code]./easy-rsa gen-req client7 ./easy-rsa sign-req client client7[/code] or [code]./easy-rsa build-client-full client7[/code] Are these two the same process ? i think, yes ? ----------------------------------------------- i have 2 problems. [i]Firstly; [/i] [u]About cert.[/u] But I was creating with pkcs.12 format on the previous server. [code]source ./vars ./build-key-pkcs12 client7[/code] [list]Which is safer and fast ? pkcs12 or ./easy-rsa build-client-full client7? Which one do you recommend ? When created with pkcs12, no need ca.crt and client7.crt ? What type of certificate(pkcs10,pkcs11 vb) is produced with the above creating I made(./easy-rsa build-client-full client7)? How to create pkcs12 with easy rsa? i could not find in the new version [/list] [i]Secondly; [/i] [u]About reneg-sec.[/u] i know what is this. Some of our branches should stay connected to the center 24/7 without interruption by OpenVpn.(I connected branches with iroute parameter to center) 1)What is the benefit of keeping this value low or high? 2)What is the harm of this value to be zero? Thank you very much for your help

Either certificate is OK, the choice is up to you. Do [b]not[/b] change your renegotiate setting because that is insecure, use the default setting.

TinCanTech Thank you very much. [quote]Do not change your renegotiate setting because that is insecure, use the default setting.[/quote] Okey. ------------------------------------------- [quote]Either certificate is OK, the choice is up to you.[/quote] [code]./easy-rsa build-client-full client7[/code] and [code]source ./vars;build-key-pkcs12 client7[/code] are same for safer and fast .? Did i understand correctly ?I asked for sure, I'm so sorry.Your answer is very important to me Thank you very much again

They are both equally secure. What matters is how you keep them once you have created them. I prefer [b]build-client-full[/b] because I then have a separate private and public key. You do what ever you need ..

About Client certificates and reneg-sec value

[deleted]

Hi
I configured my own Vpn Server on Ubuntu 20.04 LTS.
OpenVpn Server version is 2.4.7
Easy-rsa version is 3.0.4

i created a user cert below

./easy-rsa gen-req client7
./easy-rsa sign-req client client7

./easy-rsa build-client-full client7

Are these two the same process ? i think, yes ?
-----------------------------------------------
i have 2 problems.

Firstly;

About cert.

But I was creating with pkcs.12 format on the previous server.

source ./vars
./build-key-pkcs12 client7

Which is safer and fast ? pkcs12 or ./easy-rsa build-client-full client7? Which one do you recommend ?
When created with pkcs12, no need ca.crt and client7.crt ?
What type of certificate(pkcs10,pkcs11 vb) is produced with the above creating I made(./easy-rsa build-client-full client7)?
How to create pkcs12 with easy rsa? i could not find in the new version

Secondly;

About reneg-sec.
i know what is this.

Some of our branches should stay connected to the center 24/7 without interruption by OpenVpn.(I connected branches with iroute parameter to center)
1)What is the benefit of keeping this value low or high?
2)What is the harm of this value to be zero?

Thank you very much for your help

TinCanTech

Either certificate is OK, the choice is up to you.

Do not change your renegotiate setting because that is insecure, use the default setting.

[deleted]

TinCanTech
Thank you very much.

Do not change your renegotiate setting because that is insecure, use the default setting.

Okey.
-------------------------------------------

Either certificate is OK, the choice is up to you.

./easy-rsa build-client-full client7

and

source ./vars;build-key-pkcs12 client7

are same for safer and fast .?

Did i understand correctly ?I asked for sure, I'm so sorry.Your answer is very important to me

Thank you very much again

TinCanTech

They are both equally secure.

What matters is how you keep them once you have created them.

I prefer build-client-full because I then have a separate private and public key.

You do what ever you need ..

[deleted]

TinCanTech
Thank you very much for your help