How and When are OpenVPN Certificates and Keys Created?

[bnhf]

The Merlin version of AsusWRT is very nice when it comes to OpenVPN -- it's great that one doesn't have to mess around creating certificates and keys. But I'm curious how and when those keys are created for an individual router, and what process is used? Easy-RSA? What script is being using to create them, and when is it called?

 

[RMerlin]

The Merlin version of AsusWRT is very nice when it comes to OpenVPN -- it's great that one doesn't have to mess around creating certificates and keys.

That feature was actually developed by Asus.

But I'm curious how and when those keys are created for an individual router, and what process is used? Easy-RSA? What script is being using to create them, and when is it called?

They are generated the first time an OpenVPN server is started and there are no valid key/certs yet. It's generated by the rc daemon and not by a script. Part of it is done by the pkitool (included in Easy-RSA), other parts by the openssl userspace tool.