[最新版本的openvpn-2.3.1官方不再集成easy-rsa] Note that easy-rsa is no longer bundled with OpenVPN source code archives. To get it, visit the easy-rsa page on GitHub, or download it from our Linux software repositories.
# pwd/usr/local/src/openvpn/easy-rsa/easy-rsa/2.0
# lsbuild-ca build-key build-key-server clean-all openssl-0.9.6.cnf pkitool vars
build-dh build-key-pass build-req inherit-inter openssl-0.9.8.cnf revoke-full whichopensslcnf
build-inter build-key-pkcs12 build-req-pass list-crl openssl-1.0.0.cnf sign-req
# cp openssl-1.0.0.cnf /etc/openvpn/openssl.cnf# ./clean-all #初始化，清除原有不需要的文件# ./build-ca #一直回车即可Generating a 1024 bit RSA private key
.......++++++
............++++++
writing new private key to 'ca.key'-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code)[CN]:
State or Province Name (full name)[BJ]:
Locality Name (eg, city)[BJ]:
Organization Name (eg, company)[kumu]:
Organizational Unit Name (eg, section)[kumu]:
Common Name (eg, your name or your server's hostname)[kumu CA]:
Name []:kumu
Email Address [root@kumu]:
# ./build-key-server kumu_server #一路回车，密码处填写密码Generating a 1024 bit RSA private key
....................................++++++
.........++++++
writing new private key to 'kumu_server.key'-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code)[CN]:
State or Province Name (full name)[BJ]:
Locality Name (eg, city)[BJ]:
Organization Name (eg, company)[kumu]:
Organizational Unit Name (eg, section)[kumu]:
Common Name (eg, your name or your server's hostname) [kumu_server]:Name [kumu]:Email Address [root@kumu]:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:123321 #输入密码An optional company name []:kumuUsing configuration from /etc/openvpn/openssl.cnfCheck that the request matches the signatureSignature okThe Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'stateOrProvinceName :PRINTABLE:'BJ'localityName :PRINTABLE:'BJ'organizationName :PRINTABLE:'kumu'organizationalUnitName:PRINTABLE:'kumu'commonName :T61STRING:'kumu_server'name :PRINTABLE:'kumu'emailAddress :IA5STRING:'root@kumu'Certificate is to be certified until May 11 22:54:08 2023 GMT (3650 days)Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
# ./build-key kumu_client1 #一路回车，密码处填写密码Generating a 1024 bit RSA private key
..++++++
.....................++++++
writing new private key to 'kumu_client1.key'-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code)[CN]:
State or Province Name (full name)[BJ]:
Locality Name (eg, city)[BJ]:
Organization Name (eg, company)[kumu]:
Organizational Unit Name (eg, section)[kumu]:
Common Name (eg, your name or your server's hostname) [kumu_client1]:Name [kumu]:Email Address [root@kumu]:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:123321An optional company name []:kumuUsing configuration from /etc/openvpn/openssl.cnfCheck that the request matches the signatureSignature okThe Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'stateOrProvinceName :PRINTABLE:'BJ'localityName :PRINTABLE:'BJ'organizationName :PRINTABLE:'kumu'organizationalUnitName:PRINTABLE:'kumu'commonName :T61STRING:'kumu_client1'name :PRINTABLE:'kumu'emailAddress :IA5STRING:'root@kumu'Certificate is to be certified until May 11 23:01:12 2023 GMT (3650 days)Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
# ls /etc/openvpn/keys/01.pem ca.key index.txt.attr kumu_client1.crt kumu_server.crt openvpn-status.log
02.pem dh1024.pem index.txt.attr.old kumu_client1.csr kumu_server.csr serial
ca.crt index.txt index.txt.old kumu_client1.key kumu_server.key serial.old
注：生成其他客户端证书以此类推，名字不相同即可
证书加密:
12
# ./build-dh ./build-dh: line 7: dhparam: command not found
# ./build-dh Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time... ...
# openvpn --genkey --secret /etc/openvpn/keys/ta.key #生成加密key
# grep -vE '^;|^$|^#' /etc/openvpn/server.conf port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/kumu_server.crt
key /etc/openvpn/keys/kumu_server.key # This file should be kept secretdh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.10.0 255.255.255.0"# 推送路由client-to-client
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 0 # This file is secretcomp-lzo
persist-key
persist-tun
status /etc/openvpn/keys/openvpn-status.log
verb 3
