OpenVPN - Generic keys/certs? How to add client?

[trek_520]

Hi,

I finally got OpenVPN working.... I plan on putting together a guide once I have duplicated the process a couple of times.

But, how do I add more client computers? I assumed I could copy the \config directory with the client - ca.crt, client.ovpn, client.crt and client.keys. This does not work.

For more clients do the keys on the router have to be different? Is that what the client1 and 2 are for?

Sorry for he newbie questions - thanks in advance for any help.

T

 

[saintdev]

For TLS, the client keys only need to be signed using the same CA key as the server certificate.

client1/client2 are only used when the router is behaving as a client, they have nothing to do with clients connecting to the router.

 

[trek_520]

Thanks

So I am not sure what TLS really is, but I do understand the concept of signing the client keys with the master CA Key.

I guess my question was more around best practices for generating generic VS dedicated keys. Why or why not generic keys. It looks like you could create as many dedicated client keys as you would like... so how would/should you

1) keep these organized for a small group?
2) revoke dedicated keys from the router?

"client1/client2 are only used when the router is behaving as a client, they have nothing to do with clients connecting to the router." Does that mean you could have a permanent tunnel between sites without having to use the software?

 

[saintdev]

Thanks

So I am not sure what TLS really is, but I do understand the concept of signing the client keys with the master CA Key.

I guess my question was more around best practices for generating generic VS dedicated keys. Why or why not generic keys. It looks like you could create as many dedicated client keys as you would like... so how would/should you

1) keep these organized for a small group?
2) revoke dedicated keys from the router?

Typically one key per client. That way if a key gets compromised, or gets misplaced, you can revoke/reissue just that key.

Revoking keys is done with a CRL (certificate revocation list). You set crl-verify with the path to your CRL. Most likely stored on JFFS or an external drive. See the Revoking Certificates section of the OpenVPN HOWTO for more information.

Does that mean you could have a permanent tunnel between sites without having to use the software?

Between two routers running OpenVPN, yes.