Hi everyone. I'm learning, so please be kind... hard to teach old dogs new tricks. I setup OpenVPN on my tomato router so that I can reach my house to support the family while traveling. I have one client certificate, and it works fine. FYI I followed this guide: https://learntomato.flashrouters.com/setup-tomato-vpn-server-with-openvpn-tls-ssl-certificate/ Now I need to get a second client connected, and reading through the instructions I don't see a clearly delineated "create another client" process. Just hoping that someone here might be kind enough to help me learn the exact steps I have to take to get a new laptop to connect using a separate cert. so they can both be used at the same time. Very many thanks in advance! Here's to learning something new every day! John

Type: [b]build-key client-bob[/b] You may like to try https://github.com/OpenVPN/easy-rsa

[quote=TinCanTech post_id=99661 time=1622148337 user_id=37053] Type: [b]build-key client-bob[/b] You may like to try https://github.com/OpenVPN/easy-rsa [/quote] So with OpenVPN installed on my first pc - from the instructions on the site in my original post- I did this step, and installed it on the router - [i]"The ‘build-ca’ command will output two very important files; a CA certificate and key"[/i] So with that installed on the router, and the CA key on my OpenVPN installation, can I just follow the "create client" steps and have a key that will work?? That's what I'm not certain of. all my 'certificate' knowlege to date has been around the creation of stuff for webservers so I can purchase certificates.... Thanks! John

Any help guys? Thanks much in advance...

If you need help understanding tomato then ask tomato. If you need help with easy-rsa then I already gave you the link.

Hi TinCanTech! I think I have the Tomato bits down; I have one client connecting to the router now. My question is around creating additional certificates that the server will allow to connect. Thanks!

So my question is do I need to install something on the server for each client? or is the CA cert that I installed, and have on my primary PC, used when I run the client create to create a certificate that will automatically be recognized?

See: https://openvpn.net/community-resources/how-to/#setting-up-your-own-certificate-authority-ca-and-generating-certificates-and-keys-for-an-openvpn-server-and-multiple-clients

Hi Guys - I'm back... I updated to easy-rsa3. Is there a step by step document to migrate my existing CA and all that (existing easy-rsa 2 PKI) into the new PKI so I don't have to generate a new server cert and DH? i would have thought this would be in the upgrade notes, but no luck for me there :) John

[quote=TinCanTech post_id=101411 time=1628612593 user_id=37053] Did you read the help ... ? [/quote] Thanks I did - but I did not see "how to upgrade your old PKI" Which is odd as hell. You'd think that's on the first page.

Client Certificate generation

Bigjohn

TinCanTech wrote

Bigjohn wrote Easy-RSA 3 ChangeLog

3.0.8 (2020-09-09)

So: 3.0.8

tct@home:~/easy-rsa/EasyRSA-3.0.8$ ./easyrsa 

Easy-RSA 3 usage and overview

USAGE: easyrsa [options] COMMAND [command-options]

A list of commands is shown below. To get detailed usage and help for a
command, run:
  ./easyrsa help COMMAND

For a listing of options that can be supplied before the command, use:
  ./easyrsa help options

Here is the list of commands available with a short syntax reminder. Use the
'help' command above to get full usage details.

  init-pki
  build-ca [ cmd-opts ]
  gen-dh
  gen-req <filename_base> [ cmd-opts ]
  sign-req <type> <filename_base>
  build-client-full <filename_base> [ cmd-opts ]
  build-server-full <filename_base> [ cmd-opts ]
  revoke <filename_base> [cmd-opts]
  renew <filename_base> [cmd-opts]
  build-serverClient-full <filename_base> [ cmd-opts ]
  gen-crl
  update-db
  show-req <filename_base> [ cmd-opts ]
  show-cert <filename_base> [ cmd-opts ]
  show-ca [ cmd-opts ]
  import-req <request_file_path> <short_basename>
  export-p7 <filename_base> [ cmd-opts ]
  export-p8 <filename_base> [ cmd-opts ]
  export-p12 <filename_base> [ cmd-opts ]
  set-rsa-pass <filename_base> [ cmd-opts ]
  set-ec-pass <filename_base> [ cmd-opts ]
  upgrade <type>

DIRECTORY STATUS (commands would take effect on these locations)
  EASYRSA: /home/tct/easy-rsa/EasyRSA-3.0.8
      PKI: /home/tct/easy-rsa/EasyRSA-3.0.8/pki

:roll: upgrade <type>

tct@home:~/easy-rsa/EasyRSA-3.0.8$ ./easyrsa help upgrade

  upgrade <type>
      Upgrade EasyRSA PKI and/or CA. <type> must be one of:
        pki - Upgrade EasyRSA v2.x PKI to EasyRSA v3.x PKI (includes CA below)
        ca  - Upgrade EasyRSA v3.0.5 CA or older to EasyRSA v3.0.6 CA or later.

It takes a backup and runs a simulation before making any changes. And if anything goes wrong then it does a roll-back.

This is what happens on my computer.

EasyRSA Shell
# ./easyrsa upgrade ca
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[1]: @echo: not found
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[2]: rem: not found
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[3]: rem: not found
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[4]: rem: not found
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[6]: rem: not found
./easyrsa: C:/Program Files/OpenVPN/easy-rsa/pki/vars[7]: syntax error: '(' unexpected

Note: using Easy-RSA configuration from: C:/Program Files/OpenVPN/easy-rsa/pki/vars

Easy-RSA error:

echo
./easyrsa[2577]: vars file not found: bad number

TinCanTech

There is a bug.

Open easyrsa in a text editor (notepad++) and go to line 2232, look for:

	if [ $EASYRSA_FOUND_VARS -ne 1 ];
	then
		die echo "vars file not found"
	fi

Remove the 'echo' between 'die' and '"vars'

Bigjohn

For the version 2 easy RSA the vars file was 'vars.bat' - do I keep that naming convention? or rename just 'vars'?

Thanks

TinCanTech

The upgrade process should move vars.bat out of the way. Only vars is used by EasyRSA 3

Bigjohn

TinCanTech wrote The upgrade process should move vars.bat out of the way. Only vars is used by EasyRSA 3

but I need MY vars for the old/CA / cert, right?
sorry for all the questions but i'm close to having this resolved I think!
John

TinCanTech

The upgrade process builds a vars file for EasyRSA-3 from your old vars.bat file for EasyRSA-2

EasyRSA-3 does not ever use vars.bat for anything other than the above.

Bigjohn

TinCanTech wrote There is a bug.

Open easyrsa in a text editor (notepad++) and go to line 2232, look for:

	if [ $EASYRSA_FOUND_VARS -ne 1 ];
	then
		die echo "vars file not found"
	fi

Remove the 'echo' between 'die' and '"vars'

I don't see a way to do this?

TinCanTech

In your own words: hard to teach old dogs new tricks

Motivate me Financially ..

Bigjohn

TinCanTech wrote In your own words: hard to teach old dogs new tricks

Motivate me Financially ..

PM me your venmo? 🙂

TinCanTech

If you wish to contact me then there are obvious ways to do so here:
https://github.com/TinCanTech/easy-tls

300000

as I promise with you to help how to create certificate as you have hard time to make it work . you need to follow as picture or it will not work and here is the tutorial to help you

Create a folder to hold all file inside so it more quick to find what you want. Copy two importan CA certificate key with crt and key extensions.

first we need download free software from internet . just type on google XCA to go to their website and install on your computer. you can run this software on linux, window, mac so it is the same .

After install software create new profile and save in the the folder you create and we need import two CA file into that , open profile and client private tab then import CA key

mote to certificate and import public key of CA certificate as

Next we are going to create a Certificare singning requests

the click new requests and chose source and enter as picture

Move to Subject then fill out

client Generate key then leave it as

Move to Extensions and fill out all infor

move to key usage as picture then client ok

first part we have finished Certificate signing requested and we need sign it with Certificate CA

chose Certificate signing requested and then chose sign

Fill out all infor, Use this certificate for signing is your certificate name

Move to extensions and enter all infor and you need click apply

move to key usage and choose as before the click ok after that you got new client certificate to use

Click certificate and export your new certificate to use

then choose private to export your client private key to with so you got new client and two file to use

make sure you must export CA public certificate too so it will have three key to create new openvpn client

you need to follow as picture and if you got and error just post in here I can help you free of charge and this is will work 100 %

Bigjohn

@300000 -
Thanks for that - but did you mean to post pictures? they did not make it.

300000

yes i did post with picture , can you see picture or not?

Bigjohn

300000 wrote yes i did post with picture , can you see picture or not?

No - i simply see the word IMAGE where I imagine you had a picture.

Bigjohn

@300000 - if you can DM me, please do?

300000

Somehow they remove picture but when I check on my phone there are picture on that . You know this is how this forum work but I will help you now I am going to post all picture on google drive you can download all pictures start number 1 and so on . just follow pictures you check Back here and if something wrong I can help you, If you cant do it I can make a video screen to help you out . this is very simple task and only 10 minutes do to.

https://drive.google.com/drive/folders/1gaYtAkpsr1tjADvrzLxlainshkJmLMd2?usp=sharing

TinCanTech

I can also see the pictures on the forum .. I have no idea why they work only sometimes.

Pippin

Could be browser/DNS filter.
They are working here too.

TinCanTech

It's probably my \TinCan hat :mrgreen:

« Previous Page