truglodite
Regular Contributor
I am likely too late for you, but being a fellow newb I feel the pain and hope this post may save future newb suffering.
Assuming you built your keys with easyrsa according to the usual howto docs... you can (and should) edit the var file after you enter 'init-config'... before calling 'var' at the prompt. Besides making life easier by entering default cert parameters (ie Name, email, etc), you can also edit the "keysize = 1024" line to use what you want. I used 4096. The rest of the process will create keys and certs with 4096bit parameters. Beware if you thought build-dh took a while at 1024... at 4096 it will take like 50x longer.
If you will always use 4096 for any future pki's made in easyrsa, you might as well edit it into your var.example so the next 'init-config' will automatically have it in there.
On a related note, if you use tls-auth or tls-crypt, the openvpn --genkey... will still be 2048bit. Not sure if that will make it to 4096 soon, but I believe 2048 crypt is pretty friggin stout.
Kev
