Changes between Version 5 and Version 6 of EasyRSA3-OpenVPN-Howto

Timestamp:

11/30/13 22:10:26 (10 years ago)

Author:

JoshC

Comment:

benefits of unencrypted server key

EasyRSA3-OpenVPN-Howto

@@ -27 +27 @@
 ./easyrsa gen-req UNIQUE_NAME_HERE
 }}}
-  A. Optionally, the private key can be left unencrypted on-disk with the additional `nopass` option after the name. This is '''not''' recommended unless automated VPN startup is required. Unencrypted private keys can be used by anyone who obtains a copy of the file.
+  A. Optionally, the private key can be left unencrypted on-disk with the additional `nopass` option after the name. This is '''not''' recommended unless automated VPN startup is required; you may want this for your server keys, so keep this in mind. Unencrypted private keys can be used by anyone who obtains a copy of the file. Encrypted keys offer stronger protection, but will require the passphrase on initial use.
 
 3. Send the request files from each entity to the CA system. This is not security sensitive, though it is wise to verify the received file matches the sender's copy if the transport is untrusted.