Changes between Version 3 and Version 4 of TipAndDoc/network/vpn/openvpn

Timestamp:

Nov 15, 2009 11:05:07 PM (14 years ago)

Author:

mitty

Comment:

--

TipAndDoc/network/vpn/openvpn

@@ -47 +47 @@
  * openssl.cnfに対する編集([3#file2])のため、Apache用SSL証明書と同様に作成した鍵・証明書を用いると、サーバ側で「VERIFY ERROR: depth=0, error=unsupported certificate purpose: 」というエラーになり接続が維持されない。
 
+ ==== マスタCA証明書と鍵を生成する ====
+ * http://freescitech.net/2/wiki/?OpenVPN%202%20HOWTO%20%E6%97%A5%E6%9C%AC%E8%AA%9E%E8%A8%B3#abd6e0dc に従って作成する
+
+ * sudo cp -av /usr/share/doc/openvpn/examples/easy-rsa/2.0/ /etc/openvpn/easy-rsa
+ * sudo vim /etc/openvpn/easy-rsa/vars
+ * sudo su -
+ * /etc/openvpn/easy-rsa# . ./vars
+ * /etc/openvpn/easy-rsa# ./clean-all
+ * /etc/openvpn/easy-rsa# ./build-ca
+{{{
+Country Name (2 letter code) [JP]:
+State or Province Name (full name) [Ibaraki]:
+Locality Name (eg, city) [Tsukuba]:
+Organization Name (eg, company) [mitty.jp]:OpenVPN CA
+Organizational Unit Name (eg, section) []:
+Common Name (eg, your name or your server's hostname) [mitty.jp CA]:OpenVPN CA
+Email Address [root (X) mitty.jp]:
+}}}
+ * /etc/openvpn/easy-rsa# ./build-key-server server
+{{{
+Country Name (2 letter code) [JP]:
+State or Province Name (full name) [Ibaraki]:
+Locality Name (eg, city) [Tsukuba]:
+Organization Name (eg, company) [mitty.jp]:
+Organizational Unit Name (eg, section) []:OpenVPN Server
+Common Name (eg, your name or your server's hostname) [server]:server.mitty.jp
+Email Address [root (X) mitty.jp]:
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'JP'
+stateOrProvinceName   :PRINTABLE:'Ibaraki'
+localityName          :PRINTABLE:'Tsukuba'
+organizationName      :PRINTABLE:'mitty.jp'
+organizationalUnitName:PRINTABLE:'OpenVPN Server'
+commonName            :PRINTABLE:'server.mitty.jp'
+emailAddress          :IA5STRING:'root (X) mitty.jp'
+Certificate is to be certified until Nov 13 13:43:33 2019 GMT (3650 days)
+Sign the certificate? [y/n]:y
+
+
+1 out of 1 certificate requests certified, commit? [y/n]y
+Write out database with 1 new entries
+Data Base Updated
+}}}
+ * /etc/openvpn/easy-rsa# ./build-key client
+{{{
+Country Name (2 letter code) [JP]:
+State or Province Name (full name) [Ibaraki]:
+Locality Name (eg, city) [Tsukuba]:
+Organization Name (eg, company) [mitty.jp]:
+Organizational Unit Name (eg, section) []:OpenVPN Client
+Common Name (eg, your name or your server's hostname) [client]:client.mitty.jp
+Email Address [root (X) mitty.jp]:
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'JP'
+stateOrProvinceName   :PRINTABLE:'Ibaraki'
+localityName          :PRINTABLE:'Tsukuba'
+organizationName      :PRINTABLE:'mitty.jp'
+organizationalUnitName:PRINTABLE:'OpenVPN Client'
+commonName            :PRINTABLE:'client.mitty.jp'
+emailAddress          :IA5STRING:'root (X) mitty.jp'
+Certificate is to be certified until Nov 13 13:44:25 2019 GMT (3650 days)
+Sign the certificate? [y/n]:y
+
+
+1 out of 1 certificate requests certified, commit? [y/n]y
+Write out database with 1 new entries
+Data Base Updated
+}}}
+ * /etc/openvpn/easy-rsa# ./build-dh
+
+ * sudo ls -l /etc/openvpn/easy-rsa/keys/
+{{{
+-rw-r--r-- 1 root root 3928 2009-11-15 22:43 01.pem
+-rw-r--r-- 1 root root 3810 2009-11-15 22:44 02.pem
+-rw-r--r-- 1 root root 1208 2009-11-15 22:42 ca.crt
+-rw------- 1 root root  887 2009-11-15 22:42 ca.key
+-rw-r--r-- 1 root root 3810 2009-11-15 22:44 client.crt
+-rw-r--r-- 1 root root  712 2009-11-15 22:44 client.csr
+-rw------- 1 root root  887 2009-11-15 22:44 client.key
+-rw-r--r-- 1 root root  245 2009-11-15 22:45 dh1024.pem
+-rw-r--r-- 1 root root  260 2009-11-15 22:44 index.txt
+-rw-r--r-- 1 root root   20 2009-11-15 22:44 index.txt.attr
+-rw-r--r-- 1 root root   21 2009-11-15 22:43 index.txt.attr.old
+-rw-r--r-- 1 root root  130 2009-11-15 22:43 index.txt.old
+-rw-r--r-- 1 root root    3 2009-11-15 22:44 serial
+-rw-r--r-- 1 root root    3 2009-11-15 22:43 serial.old
+-rw-r--r-- 1 root root 3928 2009-11-15 22:43 server.crt
+-rw-r--r-- 1 root root  712 2009-11-15 22:43 server.csr
+-rw------- 1 root root  887 2009-11-15 22:43 server.key
+}}}
+
  * sudo mv ca.crt dh1024.pem server.* /etc/openvpn/
 {{{