I am reading Openvpn Cookbook book, one of section shows me below code, I am not quite understand that.
DH.pem is use for "perfect forward security " -- the first phase negotiation to create the first tunnel , anyone can give me more detail ?
ta.key is used to derive cipher key & HMAC key -- cipher key is used to encrypt the real user data , HMAC key is use for signing the to be sent data ?
certification can be used to sign data & encrypt data & verify partner , but the first two has been done by ta.key , why openvpn still need a cert , if openvpn use certification to sign & encrypt data & verify partner, then we don't need ta.key any more ,right ?
any one can explain that ?
ca /etc/openvpn/cookbook/ca.crt
cert /etc/openvpn/cookbook/server.crt
key /etc/openvpn/cookbook/server.key
dh /etc/openvpn/cookbook/dh2048.pem
tls-auth /etc/openvpn/cookbook/ta.key 0
