OpenVPN - generating additional client keys

[wayner]

So I have successfully set up OpenVPN using my router as the server and an iPad as the client.

I want to now set up some additional clients. Following the directions here do I just do the step of generating a new client key? Or do I have to rebuild the dh as well? That step always seems to come last in all OpenVPN tutorials that I have read and I am worried that if I just try to build a client key it will cause problems since that may be required to be done after building all server and client keys.

And when I build the client key what do I use for the common name? Do I use the name that I am putting in the command line, ie ./build-key iPhone1 - so do I now use iPhone one for the common name or do I use the same common name as I used when building the server key?

In addition, when I do the "Export ovpn file" from the Merlin web GUI - how do I know what client is being exported? Or does it matter? Can I use this one ovpn file with multiple clients?

 

[sinshiva]

when you use build-key whatever, you are just creating the key file names with the name 'whatever'. then you go through the script, just make sure the common name is unique; it will help you identify who/what is connecting in vpn status, too. i also set the 'name' to the common name, and pretty much auto-fill the rest with the script.

the diffie-hellman key is used [edit] to generate a shared secret [/edit] before the real encryption starts. at any time, you can generate a new one and replace the old without affecting any of the other keys, etc. afaik, larger DH keys provide like more possibilities of salts during encryption. too small and i guess there's more collisions/less randomness and the potential for like a quantum computer bruteforcing aes increases, or something to that effect. not an expert, so don't take this for gospel.

i have not used the export feature, but i believe it's designed to generate your basic configs and the keys are added to a folder containing the config, etc. i've only been using INLINE configurations, which i like because it means handling only a single file, but this way each OVPN will be unique to the user/device, thus requiring a bit more work