sigh

openvpn/pki/README.md

@@ -1,10 +1,14 @@
-# OpenVPN PKI — offline CA workflow
+# OpenVPN PKI — offline CA workflow (server cert only)
+
+There are **no individual client certificates** in this design — users
+authenticate with AD password + Duo. The PKI exists solely so clients can
+verify they're talking to the real server (`remote-cert-tls server`), and
+`ta.key` (tls-crypt) gates who can attempt a handshake at all.
 
 The CA private key **never touches the VPS**. Run easy-rsa on an offline
-machine (or at minimum a machine that isn't this server), then copy only the
-issued material here.
+machine, then copy only the issued material here.
 
-## One-time CA + server cert (on the offline machine)
+## One-time setup (on the offline machine)
 
 ```bash
 git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
@@ -12,39 +16,34 @@ git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
 ./easyrsa build-ca                       # sets the CA passphrase — keep offline
 ./easyrsa build-server-full racknerd-vpn nopass
 openvpn --genkey tls-crypt ta.key        # shared tls-crypt key
-./easyrsa gen-crl
 ```
 
 ## Copy to the VPS (this directory)
 
-| File on offline box                  | Name here     |
-|--------------------------------------|---------------|
-| `pki/ca.crt`                         | `ca.crt`      |
-| `pki/issued/racknerd-vpn.crt`        | `server.crt`  |
-| `pki/private/racknerd-vpn.key`       | `server.key`  |
-| `ta.key`                             | `ta.key`      |
-| `pki/crl.pem` (optional, see server.conf) | `crl.pem` |
+| File on offline box            | Name here    |
+|--------------------------------|--------------|
+| `pki/ca.crt`                   | `ca.crt`     |
+| `pki/issued/racknerd-vpn.crt`  | `server.crt` |
+| `pki/private/racknerd-vpn.key` | `server.key` |
+| `ta.key`                       | `ta.key`     |
 
 `chmod 600 server.key ta.key` after copying.
 
-## Per-user client certs (offline)
+## Client profile
 
-```bash
-./easyrsa build-client-full nick nopass
-```
+Build ONE `.ovpn` from `client/client.ovpn.template`, pasting `ca.crt` and
+`ta.key` into the inline blocks. The same profile goes to every user.
 
-Build the client's `.ovpn` from `client/client.ovpn.template`, pasting
-`ca.crt`, the client cert/key, and `ta.key` into the inline blocks.
-CN should match the AD username — the server logs use it
-(`username-as-common-name` keeps them consistent).
+## Revoking access
 
-## Revoking a client
+No client certs means no CRL — access control lives where the identity
+lives:
 
-```bash
-./easyrsa revoke nick && ./easyrsa gen-crl
-```
-
-Copy the fresh `crl.pem` here, uncomment `crl-verify` in `server.conf`, and
-`docker compose restart openvpn`.
+- **Disable the AD account** (or remove it from the VPN group if you use
+  `security_group_dn`) — kills new logins immediately.
+- Remove/disable the user in **Duo** as backup.
+- If a *profile* leaks (ta.key compromised): regenerate `ta.key`, replace
+  it here, restart openvpn, redistribute the profile — old profiles stop
+  working instantly.
 
 Everything in this directory except this README is gitignored.