apt install openvpn openssl easy-rsa

Copie des utilitaires de certificat RSA:

cp -R /usr/share/easy-rsa/* /etc/openvpn/server/

renseigner les informations de l'autorité de certification:

cd /etc/openvpn/server

Ajuster les variables:

vim vars

Insérer le contenu suivant:

export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="myhost.mydomain"
export KEY_EMAIL="me@myhost.mydomain"
export KEY_OU="MyOrganizationalUnit"

Copier le fichier de conf openssl:

cp openssl-1.0.0.cnf openssl.cnf

Charger les variables:

. ./vars

Message attendu:

NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/server/keys

Nettoyage de l'existant:

./clean-all

Création du certificat :

./build-ca

Resultat et réponses à donner:

Generating a RSA private key
.................+++++
..............+++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [SanFrancisco]:
Organization Name (eg, company) [myhost.mydomain]:
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:
Common Name (eg, your name or your server's hostname) [zweb.zikossworld.com CA]:
Name [EasyRSA]:
Email Address [me@myhost.mydomain]:

Générer la clé serveur:

./build-key-server server

mêmez réponses à donner que plus haut avec quelques éléments supplémentaires:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

...

Certificate is to be certified until May 27 10:52:54 2030 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Générer la clé client:

./build-key client1

Générer les paramètres Diffie-Hellman :

./build-dh

ln -s /etc/openvpn/server/keys/ /etc/openvpn