Open VPN Configuration File Question

[Kitsap]

Running the Open VPN server on a Netgear R9000.

When I create the four configuration files from within the router configuration page, one of the files downloaded is named ca.crt. The file contains information about the certificate authority.

Is this certificate authority information embedded in the firmware and downloaded direct from the router or is it downloaded from a Netgear server?

 

[R. Gerrits]

Running the Open VPN server on a Netgear R9000.

When I create the four configuration files from within the router configuration page, one of the files downloaded is named ca.crt. The file contains information about the certificate authority.

Is this certificate authority information embedded in the firmware and downloaded direct from the router or is it downloaded from a Netgear server?

On R7800 this certificate is generated on the router and stored somewhere in a flash partition.

I assume R9000 will do the same.
(you could check the contents of /etc/init.d/openvpn. This is the startup script for OpenVPN server on R7800. It has some functions for extracting and regenerating cert files.)

 

[Kitsap]

On R7800 this certificate is generated on the router and stored somewhere in a flash partition.

I assume R9000 will do the same.
(you could check the contents of /etc/init.d/openvpn. This is the startup script for OpenVPN server on R7800. It has some functions for extracting and regenerating cert files.)

Thank you. I will dig in to it and see what I can find.

 

[Kitsap]

On R7800 this certificate is generated on the router and stored somewhere in a flash partition.

I assume R9000 will do the same.
(you could check the contents of /etc/init.d/openvpn. This is the startup script for OpenVPN server on R7800. It has some functions for extracting and regenerating cert files.)

Yes, the OpenVPN startup script is in the same location on the R9000. Trying to decipher the script is beyond my skill set.

Trying to understand where details to update the cert files originate. When the cert files require updating, does the firmware on the router have to be updated or do the details get brought in from a Netgear server during the certificate regeneration process?

 

[R. Gerrits]

Yes, the OpenVPN startup script is in the same location on the R9000. Trying to decipher the script is beyond my skill set.

Trying to understand where details to update the cert files originate. When the cert files require updating, does the firmware on the router have to be updated or do the details get brought in from a Netgear server during the certificate regeneration process?

The generation of the openvpn certificate happens solely on the router.

when openvpn server is started for the first time (or perhaps started for the first time after factory defaults), it sees that there is not yet a certificate stored in the flash memory -> it then generates certificate and stores it in flash.

the script also has a function to regenerate the certificates. But I don't know exactly what would be triggering that function.
Also don't know for sure what the validity is if of that certificate. Could be that the validity is so long, that it will outlive the router.

But I no longer have access to my r7800 to check.

In any case, there are no Netgear servers involved in the regeneration process.

 

[Kitsap]

The generation of the openvpn certificate happens solely on the router.

when openvpn server is started for the first time (or perhaps started for the first time after factory defaults), it sees that there is not yet a certificate stored in the flash memory -> it then generates certificate and stores it in flash.

the script also has a function to regenerate the certificates. But I don't know exactly what would be triggering that function.
Also don't know for sure what the validity is if of that certificate. Could be that the validity is so long, that it will outlive the router.

But I no longer have access to my r7800 to check.

In any case, there are no Netgear servers involved in the regeneration process.

Thank you! I appreciate your taking the time to respond to my question.