50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
# OpenVPN PKI — offline CA workflow (server cert only)
|
|
|
|
There are **no individual client certificates** in this design — users
|
|
authenticate with AD password + Duo. The PKI exists solely so clients can
|
|
verify they're talking to the real server (`remote-cert-tls server`), and
|
|
`ta.key` (tls-crypt) gates who can attempt a handshake at all.
|
|
|
|
The CA private key **never touches the VPS**. Run easy-rsa on an offline
|
|
machine, then copy only the issued material here.
|
|
|
|
## One-time setup (on the offline machine)
|
|
|
|
```bash
|
|
git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
|
|
./easyrsa init-pki
|
|
./easyrsa build-ca # sets the CA passphrase — keep offline
|
|
./easyrsa build-server-full racknerd-vpn nopass
|
|
openvpn --genkey tls-crypt ta.key # shared tls-crypt key
|
|
```
|
|
|
|
## Copy to the VPS (this directory)
|
|
|
|
| File on offline box | Name here |
|
|
|--------------------------------|--------------|
|
|
| `pki/ca.crt` | `ca.crt` |
|
|
| `pki/issued/racknerd-vpn.crt` | `server.crt` |
|
|
| `pki/private/racknerd-vpn.key` | `server.key` |
|
|
| `ta.key` | `ta.key` |
|
|
|
|
`chmod 600 server.key ta.key` after copying.
|
|
|
|
## Client profile
|
|
|
|
Build ONE `.ovpn` from `client/client.ovpn.template`, pasting `ca.crt` and
|
|
`ta.key` into the inline blocks. The same profile goes to every user.
|
|
|
|
## Revoking access
|
|
|
|
No client certs means no CRL — access control lives where the identity
|
|
lives:
|
|
|
|
- **Disable the AD account** (or remove it from the VPN group if you use
|
|
`security_group_dn`) — kills new logins immediately.
|
|
- Remove/disable the user in **Duo** as backup.
|
|
- If a *profile* leaks (ta.key compromised): regenerate `ta.key`, replace
|
|
it here, restart openvpn, redistribute the profile — old profiles stop
|
|
working instantly.
|
|
|
|
Everything in this directory except this README is gitignored.
|