Changes between Version 10 and Version 11 of EasyRSA3-Insecure-PKI

Timestamp:

12/20/13 06:13:35 (10 years ago)

Author:

JoshC

Comment:

keep client/server items together

EasyRSA3-Insecure-PKI

@@ -37 +37 @@
   a. '''WARNING''': if this key is '''ever''' accessed, the person with access will be able to impersonate your server
 
-5. Build a client keypair, required for each client (key encrypted -- remember and TREAT THIS PASSPHRASE WITH CARE) with:
+5. Generate a server DH key (not security-sensitive) with:
+{{{
+./easyrsa gen-dh
+}}}
+
+6. Send the server.key, server.crt, ca.crt, and dh.pem to your server
+  a. '''WARNING''': if this key is '''ever''' cloned in transit, the person with access will be able to impersonate your server
+
+7. Build a client keypair, required for each client (key encrypted -- remember and TREAT THIS PASSPHRASE WITH CARE) with:
 {{{
 ./easyrsa build-client-full client1
 }}}
   a. '''WARNING''': if this key is '''ever''' accessed, the person with access can attempt a passphrase search or brute-force attempt on the key. If successful, the attacker will be able to impersonate your client
-
-6. Generate a server DH key (not security-sensitive) with:
-{{{
-./easyrsa gen-dh
-}}}
-
-7. Send the server.key, server.crt, ca.crt, and dh.pem to your server
-  a. '''WARNING''': if this key is '''ever''' cloned in transit, the person with access will be able to impersonate your server
 
 8. Send the client key, client crt, and ca.crt to your client.