OpenVPN custom certificates
The default OpenVPN install for Amahi will work with the certificates provided on the wiki, however there are a couple of reasons you may not want to use these. One, you can only have one client connected to the VPN at a time with these certificates and two, security best practices would advise against allowing the same certificate for all devices. Follow the instructions below to reconfigure your OpenVPN instance for use with multiple certificates. Keep in mind that when new certificates are made for your Amahi server the default profile created by the OpenVPN app will no longer work. This process will give you the files and profiles that you need in the future.
All commands are issued from the CLI as the root user unless noted otherwise.
Contents
Getting Started
Install easyrsa (The latest installations of OpenVPN do not include it.)
dnf install easy-rsa
Create a directory for working with Easy-RSA in which you will store Server keys and Certificate files.
mkdir /etc/openvpn/easy-rsa
Copy the key/certificate generation scripts installed by Easy-RSA from the default directory to the directory created above.
cp -air /usr/share/easy-rsa/3/* /etc/openvpn/easy-rsa
Navigate to /etc/openvpn/easy-rsa directory and start new PKI.
cd /etc/openvpn/easy-rsa ./easyrsa init-pki
Build the CA certificate. This will prompt you for the encryption password and the server common name.
Suggestions:
- Set the PEM password and write it down. You will be asked to confirm it. You will need it later.
- For the Common Name you can use "server," "Amahi" or the name you gave your HDA. Remember it. You will need it later.
./easyrsa build-ca
The CA certificate is stored at /etc/openvpn/easy-rsa/pki/ca.crt.
Generate Diffie-Hellman key file that can be used during the TLS handshake with connecting clients. (Depending on the speed of your server, this may take a while.)
./easyrsa gen-dh
This will generate the DH key and store as /etc/openvpn/easy-rsa/pki/dh.pem.
Generate a key and certificate file for the server. We use the name "Amahi-Server-OpenVPN" in this command so that the names for the server files match the OpenVPN config file (amahi.conf) for Amahi. When the process begins you will be prompted for a Common Name. Be sure to use the same common name you used when creating the CA certificate.
./easyrsa build-server-full Amahi-Server-OpenVPN nopass
Generating Client Keys
You will repeat this process until you have created all of the client keys you wish to have on hand.
Generate a key and certificate file for the client. In the code below, we are assuming that the client keys and certificates you wish to create follow the naming convention "client1, client2, client3," etc. You could name them anything you want as long as each name is unique.
Command for creating a client key and cert
./easyrsa build-client-full client1 nopass
You will be prompted to enter the pass phrase for the ca.cert you created earlier. Be sure to use that password.
Run the command for creating the "client2" key and cert, substituting "client2" (without the quotes) in the command. The revised command would look like this:
./easyrsa build-client-full client2 nopass
Repeat until all clients are created.
Continuing On
In case you need to invalidate a previously signed certificate, generate a revocation certificate.
./easyrsa gen-crl
This stores the revocation certificate under /etc/openvpn/easy-rsa/pki/crl.pem.
Generate TLS/SSL pre-shared authentication key
openvpn --genkey --secret /etc/openvpn/easy-rsa/pki/ta.key
This stores the ta key under /etc/openvpn/easy-rsa/pki/ta.key
Putting the New Files In Place
Backup Default files
mkdir /etc/openvpn/easy-rsa/amahi-backup
cp /etc/openvpn/amahi/* /etc/openvpn/easy-rsa/amahi-backup/
Copy files to the appropriate places. When asked if you want to overwrite the destination file, choose "y" for yes.
cp /ect/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/amahi/ca.crt cp /ect/openvpn/easy-rsa/pki/issued/Amahi-Server-OpenVPN.crt /etc/openvpn/amahi/Amahi-Server-OpenVPN.crt cp /ect/openvpn/easy-rsa/pki/private/Amahi-Server-OpenVPN.key /etc/openvpn/amahi/Amahi-Server-OpenVPN.key cp /ect/openvpn/easy-rsa/pki/ph.pem /etc/openvpn/amahi/dh.pem
Create .ovpn files
There are scripts for doing this out there but the simplest way is to edit the following and save it as an .ovpn file. (Be sure that you save this file strictly as "client1.ovpn" (for example) and not "client1.ovpn.txt" or something like that. The easiest way I found was to use Notepad++ and, when finished editing the file, choose File > Save As and under "Save Type As" choose "All Types." Then name the file "client1.ovpn" (for example) and click save.)
client dev tun proto udp resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client1.crt key client1.key comp-lzo verb 3 auth-user-pass route-method exe route-delay 2
Be sure to create one .ovpn file for each client you create. In addition,the lines "cert client1.crt" and "key client1.key" refer to the key and client certificate for a client you created. You need to change the .ovpn file to reflect the client which that .ovpn file references. (For example, if setting up client2, the lines would be "cert client2.crt" and "key client2.key" and the .ovpn file would be named "client2.ovpn". Make certain to spell the file names in the .ovpn exactly the same as the .crt and .key file names.)
Restart OpenVPN service
systemctl restart openvpn@amahi.service
Files Clients Need
Copy needed client files to an easy to access directory
mkdir [CHOSEN_LOCATION]/ovpn-clients cp /ect/openvpn/easy-rsa/pki/issued/* [CHOSEN_LOCATION]/ovpn-clients/ cp /ect/openvpn/easy-rsa/pki/private/* [CHOSEN_LOCATION]/ovpn-clients/ cp /ect/openvpn/easy-rsa/pki/ca.crt [CHOSEN_LOCATION]/ovpn-clients/
Add your client .ovpn files that you created to the "[CHOSEN_LOCATION]/ovpn-clients/" directory.
VERY IMPORTANT: Compress that "ovpn-clients" directory (into a .zip file, for example) and set a password for the compressed file. This way, anyone wanting access to any keys or certifications will have to know that password. Once the compressed file is created, delete all of the files in the "[CHOSEN_LOCATION]/ovpn-clients/" directory except the compressed file.
Setting Up Clients for Windows
Each client that you setup to use the HDAConnect3 GUI will need one common file (ca.crt) and then its own unique set of files to make the connection work.
Be sure the HDAConnect GUI is not running.
Assuming we are setting up "Client1"
In Windows,
- Go to the C:\Program Files (x86)\HDAConnect\config directory
- Delete everything contained in that config directory.
- Paste the ca.cert file to C:\Program Files (x86)\HDAConnect\config
- Paste client1.ovpn, client1.key and client1.crt to C:\Program Files (x86)\HDAConnect\config
Start HDAConnect GUI and you should be ready to connect.
Client Key Encryption Option
One could change the encryption method of the client keys to be used. We will be using triple des in this tutorial, but you can use other encryption methods if you wish.
Create a new working directory to house all the files necessary for the process.
mkdir /etc/openvpn/easy-rsa/ovpn3des
Copy all the files needed to the new directory
cp /etc/openvpn/easy-rsa/pki/private/* /etc/openvpn/easy-rsa/ovpn3des/ cp /etc/openvpn/easy-rsa/pki/issued/* /etc/openvpn/easy-rsa/ovpn3des/ cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/easy-rsa/ovpn3des/ cp /etc/openvpn/easy-rsa/pki/ph.pem /etc/openvpn/easy-rsa/ovpn3des/
Move to the working directory
cd /etc/openvpn/easy-rsa/ovpn3des
This command creates an encrypted key. Keep in mind the original key will not be impacted when doing this. You will be asked for a pass phrase.
openssl rsa -in client1.key -des3 -out client1.3des.key
Repeat this command on each key you created.
Citations
The following link was used as a primary source for the bulk of this tutorial:
Update to this wiki taken from https://ravenhawktech.com/ [1] [2]
