openvpn_inc wrote
Hello rocketman11,
It is of course a shame that the most important part of your setup was not backed up. I don't want to be the guy to rub it in - you've already received enough of that, it looks like. A lesson for the future, I guess.
If you have lost your Easy-RSA folder, your PKI is indeed pretty much wiped out. However, in theory, if you have the CA key and the CA cert, you should be able to rebuild it. But it'll be a manual process. To be honest, I am not aware of a guide that explains how to do that, as it's generally accepted that you should keep that directory safe as it's the basis of your entire trust structure in the OpenVPN solution, so there wasn't much need to create such a guide.
Personally I do not have a lot of experience with Easy-RSA, but I would imagine that if I were to try to recover from this, I would try to follow these steps - not saying these are correct, but just saying that's what I would try;
- Reference Easy-RSA documentation how the structure works
- Set up a new PKI with Easy-RSA
- Put the old CA key and CA cert in there
- Edit: I previously wrote to edit serial with last generated cert serial number, but I was pointed out that this is randomized now so no worries there apparently
- Try to create a CSR and try signing a new client cert
Ultimately, the CA is used to sign CSR for server and client certificates, and so if you use that same CA, it should work to sign new client certificates.
On a sidenote, I think tincantech has been banned for his behavior. I apologize for any inconvenience, it is after all a public forum run by the community.
Best of luck to you,
Johan
Thanks, that solved my problem. Used Easy-rsa, init-pki, replace the new ca.crt and ca.key with old ones and then build-full server and client.
