Re: Migrating OpenVPN server - easyrsa question...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Bo,

cutting to the chase ..

A brief lesson in the essence of X509.

Using Easy-RSA PKI means that all certificates MUST
be signed using the CA Private Key.

Thus, to sign a "foreign request", that which has come
from an unknown source (eg: client), use these commands:

    `import-req ~/Downloads/bob.req bob`
    `sign-req client bob`

This will sign a request from a foreign source.

----

To create a foreign request on the CA machine, try Easy-RSA
option --pki=testpki with commands `init-pki` and `gen-req`.

----

When all Private keys and Public certificates are built
on the CA signing machine (eg: The designated CA) then
use commands:

    `build-server-full server1`
    `build-client-full client1`

These will create the Private key, which MUST then be
distributed securely. And the Public certificate, which
can be shared openly. Easy-RSA will also create an
inline file for OpenVPN use but be aware of the security
aspect outlined above. Easy-RSA places the inline files
into either the pki/inline or pki/inline/private folders.

Commands `build-x-full` are simply commands `gen-req` and
`sign-req` chained together, for easy use on the designated CA.

----

Perhaps the most significant point to make is:
The Private key of the foreign entity remains private,
if the foreign entity generated the Private key for itself.


Regards



Sent with Proton Mail secure email.

-----BEGIN PGP SIGNATURE-----
Version: ProtonMail

wsC5BAEBCgBtBYJn2aaHCZBPl5z2a5C4nUUUAAAAAAAcACBzYWx0QG5vdGF0
aW9ucy5vcGVucGdwanMub3Jnfn6q7y4sOu1OL2hB8PmhZFlM7MRYVPQS/PG5
JPMA7FwWIQQJvD1EZ6ONcnnFVVVPl5z2a5C4nQAACYsIAMOeJC06rBKz2oUv
Mqw7pPTtOVpKv7i0WPuCYgjyv1CeabnJjsaPSXpAuWJeMV/TDZgJwggbGUbm
xDqS49IC4CPxq8d/wZert0BDoccDBm4+8k8+XfXnTTgF1XoEJHtYSUYsC71l
b3UvM9b1nupm5X2GwHVFQO2NJAQvYNI0DuruK0Xho7s2uPXAgklsarE4zatj
EyKWK90h3ZFGnRG1G23n2p0TCi0fllzeFqb3VdAJgQx23oE5NVW5WLvjz76g
bTCewR8aWzC4A1AmXlpC1fosrREYInPeFS26nDZ2FygR0y/zhNusnKOwGrwj
nvHNApZ4YDR1QOHX916vg5m07T0=
=1r2j
-----END PGP SIGNATURE-----

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsBNBFvwSccBCADOmHEnQlLmOjJRtJL2l53MLwwFTy7XnEps3b1Q0UwWYFCv
L2oNp0nrdGlKKDJq50Y09SR+URYBQmKmY3EmzpyUIKM/rgo1RyubHpMRHbDp
7Jp8LxkffFBVJj/t5VMpD6eMR6aUciQjgRL8NZe6+T7xfXXXwV5hoReZ3jO+
zHi6SR7xTvGXla+MQz6EEpWnlbLvg2ort9KseuVjYrqvRMxcdP0o9cZWJ5ep
JNmgeB6M7+OW08U1SsXtKrpLRcI6yKmV38jhzPr2ZgP9rmrlErR/1iqQQHXY
o8/0DfPyF0mH9ynQIiLE/l+FYu4rsG8ViKlxhXczePzAtLCjiB0a0mRVABEB
AAHNNyJ0aW5jYW50ZWNoQHByb3Rvbm1haWwuY29tIiA8dGluY2FudGVjaEBw
cm90b25tYWlsLmNvbT7CwH8EEAEIACkFAlvwSccGCwkHCAMCCRBPl5z2a5C4
nQQVCAoCAxYCAQIZAQIbAwIeAQAKCRBPl5z2a5C4nQBDB/9ZUo9BOXJR61Nm
02oZ/8aRXO9NnUSFt6GLOWcDNvAs4IJWMDVEQfYanb+421QNd/5d6H1iXF+i
4LDK0M6agC+gsNFJnjPGItvPtj7WyjynZRx8D40PPXigfHYuw2oRu0lr+P1p
1qeUe4NbcqIv8IIvLz2zClYZONgAsQVcNAHi7Z4ortQ2io2BAVj/819JPYMt
tHgY81wS1V7v8GDTZg8oaPhXGfaC4TZFGtZr/bybcqrso35jaQmC54xMbXpF
AUrc3uGVOH+OdG/BW2gcYqpvUFBukXxCUBYHP2NfXhNfzGt9nC1ulNKYeP19
TGlOorBMYIAEHoGxvpbUXfbaNWCUzsBNBFvwSccBCAC9KyVZRS5aMaG5Pi0n
fx8aNos3bYp246MtfaoKBfTQArd+GZW+WnFyJEiSyLdz0rUutyCAdf5lgVH+
WvLvImiGrSrzVpMT2nCS09LqL50Qjz8A7gp5H/hQztZ8iNysGD9NO46OnI75
90dHfCrXjQPSFtFGsTzgDxQIiMuzz9DR7BekKPmuOFIhBe9eEZqbxc8RWeQt
ha7i/DrJTRNK1aOADQFVuV1/Am5ThGPWFM/YJUyTYhMW0yePh45ObWuRQZks
l+aOm4L0KGDDYlm/FQx/EMCubvlzy/zxDdB6nqFih2qZrfymniSOKajG0joT
pZoz/Ez+4fAtg6y0PspNR6idABEBAAHCwGkEGAEIABMFAlvwSccJEE+XnPZr
kLidAhsMAAoJEE+XnPZrkLidRe0H/j5CIFIAucuaiEMkLkNKEAO5s7x47eNy
GPfZslyY+HjzGU0d07MkkGmVkPTVzwqVzNZbny7ZAv1zlW0Uy0yHp1APpyYt
8buUppTBq7d47ogxERYzt/Lc2L5a/VKFNRbhN1/XQmPiz2Ele4tyipbTapcy
+zbyfzAMD13cIdZ13hTsNP0olgBhAqUAUUYpxRlkAHeJ+Dt3NbzHS4KQK538
NJ/l7bXSKsGqoYqJeZ8VNBxwWWUbuG4jjrh43MIRgUZ5WsPUYV6Hx056kMjb
/bYBjI0TEMvH8160uqzFXeHvYyUlq0SinD/Z9ioIe8QdsHGBDUIRYYub1pO8
qrCzRZx0oNA=
=/Dea
-----END PGP PUBLIC KEY BLOCK-----