hi there,, i want to start a site for VPN . i have configured VPN on my server, but now i dont know how to setup initially, like , how to create new certificates without "clean-all" so when new customer is added, old customer's config is not damaged or changed. also i want to know how to make config valid for 1 month only. pls give me guideline or some "how-to" for it.

This is a how-to to read [url]http://www.openvpn.net/index.php/open-source/documentation/howto.html[/url].

[quote="Mimiko"]This is a how-to to read [url]http://www.openvpn.net/index.php/open-source/documentation/howto.html[/url].[/quote] thats good man, but i think i have written in the post that what i need to know, you have given the standard how to link. i need something more then that.

I'm a lady. To create a new client key: [url]http://www.openvpn.net/index.php/open-source/documentation/howto.html#pki[/url] [code]build-key new_common_name[/code]. [quote]how to make config valid for 1 month only.[/quote] The client configuration is a text file and does not have a validation time. You can use certificate revoking for this purpose: [url]http://www.openvpn.net/index.php/open-source/documentation/howto.html#revoke[/url], manually or in a cron script. The how-to has everything needed to a standart setup.

for example, i have created 5 users at the time of setup. now i want to add 6th user after 10 days of setup, without effecting old user's certificates, how i can do it?

To add new certificates for new users, use: [code]./vars ./build-key client5 ./build-key client6 ./build-key client7[/code] And so on.

[quote="Mimiko"]To add new certificates for new users, use: [code]./vars ./build-key client5 ./build-key client6 ./build-key client7[/code] And so on.[/quote] thanks, it works fine now :)

Or simply use an interface wherein you can automatically suspend the user in a certain number of days. well, at least it worked on my setup :)

[quote="delirium"]Or simply use an interface wherein you can automatically suspend the user in a certain number of days. well, at least it worked on my setup :)[/quote] where can i get interface like that? do you have any GUI for OpenVPN certificates management? also, i am curruntly giving UDP 53 port . but now i also want to offer UDP 9200 port ( with lport 53) . what should i change in my server config and client configs?

also, when i am trying to revoke the configs, then this error comes Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf CA certificate and CA private key do not match 19730:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:398: Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf CA certificate and CA private key do not match 19731:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:398: demo20.crt: /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=demo20/emailAddress=me@myhost.mydomain error 20 at 0 depth lookup:unable to get local issuer certificate

I don't have GUI for certificates management. I just let my users run using a single certificate. I found it to be a tedious process to provide them with individual certificates. Instead, I had them authenticated through username/password combo. Which is, then, managed with a GUI wherein I can control the authentication through - created /suspend/delete. And is also partially automated on monthly, quarterly, semi-annually, to annual subscriptions. Through that, I don't have to revoke certificates every now and then.

[Resolved] i want to open a VPN site via OpenVPN

janjust

revoking a certificate using 'revoke-full' is not enough; you also need to update the .crl file on the server . This .crl file needs to be loaded into the server using

crl-verify <full-path-to-crl-file>

dhruvpandit

janjust wroterevoking a certificate using 'revoke-full' is not enough; you also need to update the .crl file on the server . This .crl file needs to be loaded into the server using
crl-verify <full-path-to-crl-file>

i have added this link also, but pls tell me how to restart openvpn?

and i am using centos, so restarted via "service openvpn restart"
but its not starting now.
🙁

can you tell me any other method to restart openvpn so i can not get any error after editing .conf file?

maikcat

please post server logs to determine why the service doesnt start.

Michael.

ps: service openvpn restart is correct on centos

dhruvpandit

here is my server file :

local SERVER IP #- your_server_ip
port 53 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
crl-verify /etc/openvpn/easy-rsa/2.0/keys/crl.pem
server 1.2.3.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

here is my client config :

client
dev tun
proto udp #- protocol
remote SERVER 53 #- SERVER IP and OPENVPN Port
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
cert dhruv.crt
key dhruv.key
lport 53

comp-lzo
verb 3

will revoke of certificates works with this configs??
or anything else to be done on any site??

maikcat

server config looks ok..

server log file please.

Michael

dhruvpandit

thanks.

can anyone tell me how i can manage my certificates with GUI??

and anyone knows how to integrate it with whmcs?

if anyone knows, pls tell me how to automatically revoke / create certificates.

« Previous Page