racknerd/openvpn/pki/README.md

OpenVPN PKI — offline CA workflow

The CA private key never touches the VPS. Run easy-rsa on an offline machine (or at minimum a machine that isn't this server), then copy only the issued material here.

One-time CA + server cert (on the offline machine)

git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
./easyrsa init-pki
./easyrsa build-ca                       # sets the CA passphrase — keep offline
./easyrsa build-server-full racknerd-vpn nopass
openvpn --genkey tls-crypt ta.key        # shared tls-crypt key
./easyrsa gen-crl

Copy to the VPS (this directory)

File on offline box	Name here
pki/ca.crt	ca.crt
pki/issued/racknerd-vpn.crt	server.crt
pki/private/racknerd-vpn.key	server.key
ta.key	ta.key
pki/crl.pem (optional, see server.conf)	crl.pem

chmod 600 server.key ta.key after copying.

Per-user client certs (offline)

./easyrsa build-client-full nick nopass

Build the client's .ovpn from client/client.ovpn.template, pasting ca.crt, the client cert/key, and ta.key into the inline blocks. CN should match the AD username — the server logs use it (username-as-common-name keeps them consistent).

Revoking a client

./easyrsa revoke nick && ./easyrsa gen-crl

Copy the fresh crl.pem here, uncomment crl-verify in server.conf, and docker compose restart openvpn.

Everything in this directory except this README is gitignored.