Note: using Easy-RSA configuration from: /usr/local/EasyRSA-3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating RSA private key, 2048 bit long modulus ......+++ .....................+++ e is 65537 (0x10001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- # 定义一个 CA证书名称 Common Name (eg: your user, host, or server name) [Easy-RSA CA]:lyc7456.com
CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt
查看 CA 证书：
1 2 3 4 5 6
$ ls -l pki/ca* pki/private/ca* -rw------- 1 root root 1172 May 6 16:30 pki/ca.crt -rw------- 1 root root 1675 May 6 16:30 pki/private/ca.key
Note: using Easy-RSA configuration from: /usr/local/EasyRSA-3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-20171.iKnbjV/tmp.UYdnfv
An updated CRL has been created. CRL file: /etc/openvpn/easy-rsa/pki/crl.pem
Note: using Easy-RSA configuration from: /usr/local/EasyRSA-3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key ..............................+++ ........................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-20203.iO9a0j/tmp.PjYPZd' ----- Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-20203.iO9a0j/tmp.gwy54A Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server' Certificate is to be certified until May 3 09:30:40 2032 GMT (3650 days) # 有效期10年 Write out database with 1 new entries Data Base Updated
查看证书
1 2 3 4 5 6 7
# 服务器证书位置 $ ls -l pki/issued/server.crt pki/private/server.key -rw------- 1 root root 4547 May 6 17:30 pki/issued/server.crt -rw------- 1 root root 1708 May 6 17:30 pki/private/server.key
cd /etc/openvpn/easy-rsa ./easyrsa build-client-full user001 nopass
Note: using Easy-RSA configuration from: /usr/local/EasyRSA-3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key ..................+++ .............................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-20327.8ZOZXa/tmp.3nt3pw' ----- Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-20327.8ZOZXa/tmp.61tIhQ Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'user001' Certificate is to be certified until May 3 09:36:34 2032 GMT (3650 days) # 有效期10年 Write out database with 1 new entries Data Base Updated
查看证书
1 2 3 4 5 6 7
# 证书位置 $ ls -l pki/issued/user001* pki/private/user001* -rw------- 1 root root 4437 May 6 16:54 pki/issued/user001.crt -rw------- 1 root root 1704 May 6 16:54 pki/private/user001.key
$ vim /etc/openvpn/client/agent_template.ovpn client proto udp dev tun nobind remote ${OPENVPN_SERVER_HOSTS} 1194 ca ca.crt cert user.crt key user.key tls-auth ta.key 1 remote-cert-tls server persist-tun persist-key comp-lzo verb 3 mute-replay-warnings
Note: using Easy-RSA configuration from: /usr/share/easy-rsa/3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key ......+++ ..+++ writing new private key to '/etc/openvpn/easy-rsa/3/pki/easy-rsa-22118.7RWFvd/tmp.uKvcV1' ----- Using configuration from /etc/openvpn/easy-rsa/3/pki/easy-rsa-22118.7RWFvd/tmp.oFIaSm Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'user001' Certificate is to be certified until Jul 25 06:05:57 2024 GMT (825 days) Write out database with 1 new entries Data Base Updated adding: user001/ (stored 0%) adding: user001/ca.crt (deflated 27%) adding: user001/user001.crt (deflated 45%) adding: user001/user001.key (deflated 23%) adding: user001/user001.ovpn (deflated 30%) adding: user001/ta.key (deflated 40%)
# 吊销客户端证书 $ cd /etc/openvpn/easy-rsa $ ./easyrsa revoke user001
Note: using Easy-RSA configuration from: /usr/local/EasyRSA-3.0.8/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Please confirm you wish to revoke the certificate with the following subject:
subject= commonName = user001
Type the word 'yes' to continue, or any other input to abort. Continue with revocation: yes # 输入 yes Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-20412.oWky4r/tmp.QdaEcP Revoking Certificate DE193FB7B09E369896440B91E0C80313. Data Base Updated
IMPORTANT!!!
Revocation was successful. You must run gen-crl and upload a CRL to your infrastructure in order to prevent the revoked cert from being accepted.
重新生成吊销列表。
1
$ ./easyrsa gen-crl
openvpn 服务器端配置文件，需要配置引用吊销列表。
1 2 3
$ vim /etc/openvpn/server/server.conf .... # 省略其他 crl-verify /etc/openvpn/easy-rsa/3/pki/crl.pem
./easyrsa renew client1.domain.tld Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Please confirm you wish to renew the certificate with the following subject:
subject= commonName = client1.domain.tld
Type the word 'yes' to continue, or any other input to abort. Continue with renew: <输入yes>
Easy-RSA error:
Certificate expires in more than 30 days. Renewal not allowed.
通过配置参数来改变这个时间
1 2
$ vi vars set_var EASYRSA_CERT_RENEW 1000
再次执行
1
./easyrsa renew ${commonName}
直接重新创建同名客户端证书，也会更新。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
./easyrsa build-client-full lyc nopass
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-3.0.7/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key .+++ ..........+++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-59177.F1XPtP/tmp.GmWJjT' ----- Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-59177.F1XPtP/tmp.fGeagf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'lyc' Certificate is to be certified until Oct 24 06:57:28 2032 GMT (3650 days) Write out database with 1 new entries Data Base Updated
