Breadcrumbs

(Optional) Install and Configure Certificate Authority

Steps below are only for demonstration. Follow OpenVPN documentation for more details about the CA configuration for production environment.

  1. Go to directory C:\Program Files\OpenVPN\easy-rsa and run EasyRSA-Start.bat.

›_ Console 

> EasyRSA-Start.bat
image-3284893889-1.jpg

EasyRSA shell

  1. Initializes the PKI directory for a new PKI.

›_ Console 

> ./easyrsa init-pki
image-3284893889-2.jpg

init-pki command output

  1. Creates a new CA.

›_ Console 

> ./easyrsa build-ca nopass
image-3284893889-3.jpg

Building CA

image-3284893889-4.jpg

Building CA

  1. Generate a keypair and certificate for the server.

›_ Console 

> ./easyrsa build-server-full server nopass
image-3284893889-5.jpg

Creating server key and certificate

image-3284893889-6.jpg

Creating server key and certificate

  1. Generate dh parameter required by server during TLS handshake while connecting with clients.

›_ Console 

> ./easyrsa gen-dh
image-3284893889-7.jpg

Generation of dh parameter

image-3284893889-8.jpg

Generation of dh parameter

  1. Add or update the following lines in C:\Program Files\OpenVPN\configauto\server.ovpn file.

server.ovpn

 
ca ca.crt  
cert server.crt  
key server.key  
dh dh.pem

  1. Restart OpenVPN from services.

image-3284893889-9.jpg

OpenVPN service