OpenVPN PKI — offline CA workflow (server cert only)

There are no individual client certificates in this design — users authenticate with AD password + Duo. The PKI exists solely so clients can verify they're talking to the real server (remote-cert-tls server), and ta.key (tls-crypt) gates who can attempt a handshake at all.

The CA private key never touches the VPS. Run easy-rsa on an offline machine, then copy only the issued material here.

One-time setup (on the offline machine)

git clone https://github.com/OpenVPN/easy-rsa.git && cd easy-rsa/easyrsa3
./easyrsa init-pki
./easyrsa build-ca                       # sets the CA passphrase — keep offline
./easyrsa build-server-full racknerd-vpn nopass
openvpn --genkey tls-crypt ta.key        # shared tls-crypt key

Copy to the VPS (this directory)

File on offline box	Name here
`pki/ca.crt`	`ca.crt`
`pki/issued/racknerd-vpn.crt`	`server.crt`
`pki/private/racknerd-vpn.key`	`server.key`
`ta.key`	`ta.key`

chmod 600 server.key ta.key after copying.

Client profile

Build ONE .ovpn from client/client.ovpn.template, pasting ca.crt and ta.key into the inline blocks. The same profile goes to every user.

Revoking access

No client certs means no CRL — access control lives where the identity lives:

Disable the AD account (or remove it from the VPN group if you use security_group_dn) — kills new logins immediately.
Remove/disable the user in Duo as backup.
If a profile leaks (ta.key compromised): regenerate ta.key, replace it here, restart openvpn, redistribute the profile — old profiles stop working instantly.

Everything in this directory except this README is gitignored.