starcraftcats
I have my windows client laptop setup with the openvpn client crt and key in the Windows crypto store. Is there any reason why I can't add ca.crt and ta.key in there as well?
Not sure why openvpn client can't extract them from the store... i'd rather not have anything secret in plain text on my HDD.
janjust
the ca.crt is public information and can be stored on disk.
the ta.key file format is a proprietary OpenVPN format , of which the Windows cryptostore is not aware. Hence the ta.key cannot be stored in the cryptostore (nor on a pkcs11 device).
starcraftcats
Ah ok, I didn't realise that crt files aren't secret. In your book you put both crt and key files into the crypt store, so i thought it must be important to keep both kinds of file secret.
As for ta.key I guess it'll just have to remain in plain text. Thanks for replying.
