Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Get OpenVPN config files from SSH or something else.

    Scheduled Pinned Locked Moved OpenVPN
    7 Posts 2 Posters 601 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      CarolBrown
      last edited by

      Hello! I have an idea to make a Group Policy on my Windows server for automatic deploying the OpenVPN client and its config on "road-warriors'" computers. So I wonder if there is a way to create certificate and export OpenVPN config via SSH? Then I could make any script to do it automatically. Or maybe I can use something else, easier way? Thanks!

      1 Reply Last reply Reply Quote 0
      • JeGrJ
        JeGr LAYER 8 Moderator
        last edited by

        If you want to automate it outside of pfSense, I'd recommend you export the OpenVPN CA and let your Windows Server create certificates itself. There's no need the certs have to be configured/created in pfSense. Just that the CA/CA chain is the same. So you could export your CA cert and key, install that on your windows or scripting host and create certificates there to get packaged with your configuration. Config itself can be broken down to generic naming of certificates etc so there's no real user part in it so it can be essentially the same for everyone. Only thing needed would be the user crt and to bundle the ca.crt, dh.key and user.crt with the generic_config.ovpn and you're done :)

        Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

        If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

        C 1 Reply Last reply Reply Quote 1
        • C
          CarolBrown @JeGr
          last edited by

          @JeGr
          I am very thankful to you for your advice. Evidently I forgot about this feature. It remains only to find a solution for the second trouble.

          1 Reply Last reply Reply Quote 0
          • JeGrJ
            JeGr LAYER 8 Moderator
            last edited by

            What second trouble?

            Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

            If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

            C 1 Reply Last reply Reply Quote 0
            • C
              CarolBrown @JeGr
              last edited by

              @JeGr I need install OpenVPN EasyRSA. I thought I could use standard WIndows Certificate Authority before.

              JeGrJ 1 Reply Last reply Reply Quote 0
              • JeGrJ
                JeGr LAYER 8 Moderator @CarolBrown
                last edited by JeGr

                @CarolBrown No you don't. Who says you need a special kind of CA? That's nonsense :) All you need is to import your CA and its key and then start happily creating user certs. Just export the right format (PEM). But there's nothing special in either OpenVPN EasyRSA (which is simply a bunch of scripts to make creating certs via OpenSSL(!) easier!) or Windows CA.

                Besides: as you will need some form of programming/scrpiting anyway to bundle your stuff, you can also just use openssl yourself and create the certs via command line/powershell/whatever way. The EasyRSA scripts can be easily used as a base for scripting yourself.

                Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                C 1 Reply Last reply Reply Quote 1
                • C
                  CarolBrown @JeGr
                  last edited by

                  @JeGr Thanks a lot! I'll be trying.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.