Here are my deployment instructions: (arguably contrived and could be condensed)
Install yubikey manager
install opensc
https://github.com/OpenSC/OpenSC/wiki
create profile on VPN Server using ./openvpn-install.sh
use a complex password
copy the ovpn config to your local linux computer in its own folder
break out the client.key, client.crt and ca.crt into their own files (leave the tls.crypt)
run the following command
openssl pkcs12 -export -out cert_key.p12 -inkey client.key -in client.crt -certfile ca.crt -nodes
enter in the current password that you set when the key was created
do not enter an export password
copy the cert_key.p12 to a usb stick and move it to a windows computer
start yubikey manager
disable the nfc functions of the yubikey5 except otp
set the pin, puk and leave management pins default, store them in lastpass
DO NOT set the pin on the management key
upload the cert_key.p12 to the yubikey to the
applications home/piv/certificate/authentication slot - protect with pin
bring the yubikey back to your linux computer
run the following command
(su -) openvpn --show-pkcs11-ids /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
use this to generate a serialized id for the template below. (see piv_II section below)
update the CA and TA sections with the updated values from your ovpn export
ensure you cleanup your errant files properly at the completion of the job
use this template below to generate the ovpn file for the client computer
Client Template:
client
proto udp
remote xxxxxxxxxxxxxxxxx 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_dRMfwKC3cqAwvBp2 name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
pull-filter ignore "redirect-gateway"
route 192.168.1.0 255.255.255.0 10.8.0.1
verb 3
pkcs11-providers 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll'
pkcs11-id 'piv_II/PKCS\x2315\x20emulated/xxxserial herexxxxxx/xxxxxkey name herexxxxxx/01'
<ca>
copy ca here
</ca>
<tls-crypt>
copy tls here
</tls-crypt>
