Changes between Version 15 and Version 16 of EasyRSA3-OpenVPN-Howto

Timestamp:

10/28/20 15:11:18 (3 years ago)

Author:

tct

Comment:

--

EasyRSA3-OpenVPN-Howto

@@ -82 +82 @@
 ./easyrsa gen-dh
 }}}
+
+== PKI procedure: Producing your complete PKI on the CA machine ==
+
+It is most common for beginners to produce a complete PKI on one machine and then distribute the files as needed.  If you have followed the steps above and already have a partial PKI then make sure you do not over write it.  The simplest approach is to make a complete copy of Easyrsa3 in a new folder.
+
+Starting with a fresh copy of Easyrsa3 follow these steps:
+
+Copy the file `vars.example` to file named `vars` and open `vars` for editing.
+Read through `vars` for instructions on what to edit.
+For example, you can chose if your PKI will use RSA or Elliptic Curve cryptography.
+Save your changes and close `vars`.
+
+Initialise your PKI:
+{{{
+./easyrsa init-pki
+}}}
+Create your CA:
+{{{
+./easyrsa build-ca
+}}}
+  Option `nopass` can be used to disable password locking the CA.
+
+Build a server certificate and key:
+{{{
+./easyrsa build-server-full <SERVER_NAME>
+}}}
+  Replace `<SERVER_NAME>` with your server name.  eg. `Server-01` [[br]]
+  Option `nopass` can be used to disable password locking the key. [[br]]
+
+Build a client certificate and key:
+{{{
+./easyrsa build-client-full <CLIENT_NAME>
+}}}
+  Replace `<CLIENT_NAME>` with your client name.  eg. `Client-01` or `alice` [[br]]
+  Option `nopass` can be used to disable password locking the key. [[br]]
+  Repeat for all clients. [[br]]
+
+Using this method, server and client keys must be distributed over a secure medium, such as using SFTP.
+
+Finally, you can use [https://github.com/TinCanTech/easy-tls Easy-TLS] to add the finishing touches to your PKI.
+
+
+Download `easytls` to your current EasyRSA-3 working directory and follow these steps:
+
+Initialise Easy-TLS:
+{{{
+./easytls init-tls
+}}}
+  This creates a directory called `easytls` in your current PKI directory (Default: `pki/easytls`)
+
+Create a TLS-AUTH key:
+{{{
+./easytls build-tls-auth
+}}}
+
+Create a TLS-CRYPT key:
+{{{
+./easytls build-tls-crypt
+}}}
+
+Create a TLS-CRYPT-V2 server key:
+{{{
+./easytls build-tls-crypt-v2-server <SERVER_NAME>
+}}}
+  This key **must** be kept secure.
+Create a TLS-CRYPT-V2 client key:
+{{{
+./easytls build-tls-crypt-v2-client <SERVER_NAME> <CLIENT_NAME>
+}}}
+  The Server key is used to encrypt the client key which is why the server key must also be specified.
+
+Now Easy-TLS can create `.inline` files for each of your VPN nodes.
+
+Depending on which type of TLS key you are using (TLS auth, crypt or crypt-v2) build an inline file:
+{{{
+./easytls inline-tls-auth Server-01
+}}}
+  Repeat for all your VPN nodes. [[br]]
+
+If you used the first method to build your PKI and do not have access to the keys of each of your nodes then you can still use Easy-TLS to build `.inline` files by using the option `nokey`.  This will build `.inline` files which leave the inline `<key></key>` field blank so that the key can be pasted in by the respective user.