Some questions about OpenVPN components….

XZed · Dec 23, 2009, 9:56 PM

Hello,

I'm using with success this howto on some pfsense setup (also : http://doc.pfsense.org/index.php/VPN_Capability_OpenVPN )…

Meanwhile, i have two problems/requests :

When setting up manually openvpn (on a classic linux box), i could use "./pkitool --initca --pass" to create a protected CA (in order that only someone knowing the passphrase could issue certificates) create clients...

With the easy-rsa package content ( http://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html ), i don't have the "pkitool" command...

I read that "pkitool --initca" = "build-ca" : does that mean i could use "build-ca --pass" (does it even exist ?) in order to create a protected CA ?

Or do you use it differently (the main goal : protect CA / avoid unauthorized certificates issuing) ? How do you protect CA ?

When issuing certificates, i have, at the end, the following message :

"unable to write random state"

I think it's due to incorrect HOME / RANDFILE variables on openssl.cnf file... Well i didn't it because i don't know if my thoughts are right or if there are another variables to change...

By the way, i change HOME variable in vars.bat in order to issue certificates...

Certificates are well issued and work perfectly but this error message remains...

I wanted to know :

What does this *.rnd serve to ? Does it serve to generate random ciphering for certificates issuing ? In other words : can we simply ignore it ?

Thank you very much,

XZed

jimp · Dec 24, 2009, 2:40 AM

You're probably better off following this for making keys/certs:

http://doc.pfsense.org/index.php/Easyrsa_for_pfSense

XZed · Dec 24, 2009, 5:38 PM

@jimp:

You're probably better off following this for making keys/certs:

http://doc.pfsense.org/index.php/Easyrsa_for_pfSense

Well i remember have used easy-rsa for pfsense, at its beginnings… but it was still in "beta"... but it seems to be right now ;D

So, i'll give it a try and will feedback here ;D !

Just a question :

I suppose there isn't any package to backup folders (to backup easyrsa4pfsense folder) ? Well, winscp will be sufficient ^^ !

Thanks

jimp · Dec 24, 2009, 6:19 PM

There is a package, it's called "Backup" and you can set it up to archive any directories you want for download.

SCP also works.

XZed · Dec 26, 2009, 9:28 AM

@jimp:

There is a package, it's called "Backup" and you can set it up to archive any directories you want for download.

SCP also works.

Thank you very much !

Sincerely,

XZed

XZed · Mar 13, 2010, 1:35 AM

@XZed:

@jimp:

You're probably better off following this for making keys/certs:

http://doc.pfsense.org/index.php/Easyrsa_for_pfSense

Well i remember have used easy-rsa for pfsense, at its beginnings… but it was still in "beta"... but it seems to be right now ;D

So, i'll give it a try and will feedback here ;D !

Just a question :

I suppose there isn't any package to backup folders (to backup easyrsa4pfsense folder) ? Well, winscp will be sufficient ^^ !

Thanks

I replied to this old post in order to give some feedback :

Indeed, the easyrsa package is very nice ! But, pfSense 2.x brings many nice changes to OpenVPN management (CRL missing in 2.x ?? How to do ?? Perhaps will be corrected in final version ?) ;D !

Thank you