how to add another client cert in openvpn

shy.newbie

Hi,

I'm fairly new in openvpn and I would like to add another openvpn client in an existing openvpn setup. I do understand that the client needs to have the ca cert, client cert and client key. However, everytime I try to create a cert for the client, I get this errror:

myfw1:/usr/share/doc/openvpn/examples/easy-rsa# ./build-key client12
you must define KEY_DIR

Instructions on the document tell me to perform ./vars then ./clean-all and ./build-ca but I already have a ca and I'm hesitant to do this because it will clear all of the existing certs including the already created client certs.

Please direct me on how I should proceed and correct me if I misunderstood the concept of cleaning of ./vars part. If performing that will not delete my existing certs, please let me know.

I just don't want to perform it and eventually delete the working ca and certs for server and clients.

Thanks so much.

maikcat

assuming you have vars ca.key ca.crt index.txt serial.txt and the rest of files you do

source ./vars
./build-key keyname

and you are done.

DONT do clean-all... 😉

michael

shy.newbie

great! thanks for the clarification...

also, I need to go one more directory down which is

/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys

and am creating certs for new clients. 🙂

kuyajhun316

i am honestly new in linux, please guide me with the instructions (cli in particular) to create new client. t.t
i tried the above instructions but it seem nothing happen.

[root@asap1 easy-rsa]# /etc/openvpn/easy-rsa/vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/ keys

[root@asap1 easy-rsa]# /etc/openvpn/easy-rsa/build-key dav52
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.

after that, i checked if it created the key in ../keys but there was no "dav52"

Please help. TIA. :roll: