469
edits
Changes
Jump to navigation
Jump to search
Created page with "We're using OpenVPN with a TLS infrastructure. Clients can only connect with a certificate that has been signed by the servers CA. The server needs the following files, in ord..."
We're using OpenVPN with a TLS infrastructure. Clients can only connect with a certificate that has been signed by the servers CA.
The server needs the following files, in order to properly serve clients:
* ca.crt ''(generated by easy-rsa)''
* ca.key ''(generated by easy-rsa)''
* dh4096.pem ''(generated by openssl)''
* server.conf ''(written by you from template)''
* server.key ''(generated by openvpn)''
== Setting up the Server ==
Our Docker image comes with all necessary binaries, to run the server. To seed the configuration you should switch into a shell in the image with a command like <code>docker exec -it zombi/openvpn</code>. The following steps assume that you are within the OpenVPN container.
=== Generate Static Key ===
Within ''/etc/openvpn'', execute <code>openvpn --genkey --secret server.key</code> to generate the OpenVPN static key.
=== Build CA ===
Run <code>/usr/share/easy-rsa/easyrsa init-pki</code> and <code>/usr/share/easy-rsa/easyrsa build-ca nopass</code> to build the CA (depending on your usecase, you might want to set a passphrase and remove the "nopass") and copy the files ca.crt and private/ca.key to /etc/openvpn.
=== Generate Diffie Hellman Parameters ===
Within ''/etc/openvpn'', run <code>openssl dhparam -out dh4096.pem 4096</code>. This takes a long time, a smaller prime is probably enough and generates way faster, so if you want to be slightly less secure, but way faster, you might want to consider using 1024 or 2048 instead of 4096.
[[Category:Documentation]]
The server needs the following files, in order to properly serve clients:
* ca.crt ''(generated by easy-rsa)''
* ca.key ''(generated by easy-rsa)''
* dh4096.pem ''(generated by openssl)''
* server.conf ''(written by you from template)''
* server.key ''(generated by openvpn)''
== Setting up the Server ==
Our Docker image comes with all necessary binaries, to run the server. To seed the configuration you should switch into a shell in the image with a command like <code>docker exec -it zombi/openvpn</code>. The following steps assume that you are within the OpenVPN container.
=== Generate Static Key ===
Within ''/etc/openvpn'', execute <code>openvpn --genkey --secret server.key</code> to generate the OpenVPN static key.
=== Build CA ===
Run <code>/usr/share/easy-rsa/easyrsa init-pki</code> and <code>/usr/share/easy-rsa/easyrsa build-ca nopass</code> to build the CA (depending on your usecase, you might want to set a passphrase and remove the "nopass") and copy the files ca.crt and private/ca.key to /etc/openvpn.
=== Generate Diffie Hellman Parameters ===
Within ''/etc/openvpn'', run <code>openssl dhparam -out dh4096.pem 4096</code>. This takes a long time, a smaller prime is probably enough and generates way faster, so if you want to be slightly less secure, but way faster, you might want to consider using 1024 or 2048 instead of 4096.
[[Category:Documentation]]
