# OpenVPN PKI — offline CA workflow (server cert only)

There are **no individual client certificates** in this design — users
authenticate with AD password + Duo. The PKI exists solely so clients can
verify they're talking to the real server (`remote-cert-tls server`), and
`ta.key` (tls-crypt) gates who can attempt a handshake at all.

The CA private key **never touches the VPS**. Run easy-rsa on an offline
machine, then copy only the issued material here.

## One-time setup (on the offline machine)

```bash
git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
./easyrsa init-pki
./easyrsa build-ca                       # sets the CA passphrase — keep offline
./easyrsa build-server-full racknerd-vpn nopass
openvpn --genkey tls-crypt ta.key        # shared tls-crypt key
```

## Copy to the VPS (this directory)

| File on offline box            | Name here    |
|--------------------------------|--------------|
| `pki/ca.crt`                   | `ca.crt`     |
| `pki/issued/racknerd-vpn.crt`  | `server.crt` |
| `pki/private/racknerd-vpn.key` | `server.key` |
| `ta.key`                       | `ta.key`     |

`chmod 600 server.key ta.key` after copying.

## Client profile

Build ONE `.ovpn` from `client/client.ovpn.template`, pasting `ca.crt` and
`ta.key` into the inline blocks. The same profile goes to every user.

## Revoking access

No client certs means no CRL — access control lives where the identity
lives:

- **Disable the AD account** (or remove it from the VPN group if you use
  `security_group_dn`) — kills new logins immediately.
- Remove/disable the user in **Duo** as backup.
- If a *profile* leaks (ta.key compromised): regenerate `ta.key`, replace
  it here, restart openvpn, redistribute the profile — old profiles stop
  working instantly.

Everything in this directory except this README is gitignored.