Changes between Version 8 and Version 9 of EasyRSA3-OpenVPN-Howto

Timestamp:

12/01/13 10:37:53 (10 years ago)

Author:

JoshC

Comment:

improve overview; add DH generation

EasyRSA3-OpenVPN-Howto

@@ -7 +7 @@
 The best way to create a PKI for OpenVPN is to separate your CA duty from each server & client. The CA should ideally be on a secure environment (whatever that means to you.) Loss/theft of the CA key destroys the security of the entire PKI.
 
-== Separate CA system procedure ==
+To use Easy-RSA to set up a new OpenVPN PKI, you will:
+
+1. Set up a CA PKI and build a root CA
+
+2. Configure secondary PKI environments on your server and each client and generate a keypair & request on them
+
+3. Send the certificate requests to the CA, where the CA signs and returns a valid certificate
+
+4. On your OpenVPN server, generate DH parameters (see the DH Generation section of this Howto)
+
+== PKI procedure: using a separate CA system ==
 
 Pick locations for the CA and each entity that will be assigned certs. All keypair/request generation should occur on the target system that will use them; put another way, generate your client & server requests/keys on each system for best security.
@@ -51 +61 @@
 
 6. The CA returns the signed certificate, and includes the CA certificate unless the client already has it. This can be done over an insecure channel, though the client is encouraged to confirm the received CA cert is valid if the transport is untrusted.
+
+== DH Generation ==
+
+On the PKI for the OpenVPN server, this command will generate DH parameters used during the TLS handshake with connecting clients. The DH params are not security sensitive.
+
+{{{
+./easyrsa gen-dh
+}}}