OpenVPN:Certificate Management - Revision history

Josh: Major update - troubleshooting guide: OpenVPN Certificate Management (31 sections)

2026-01-01T13:44:51Z

Major update - troubleshooting guide: OpenVPN Certificate Management (31 sections)

← Older revision		Revision as of 13:44, 1 January 2026
Line 1:		Line 1:
	~~= OpenVPN Certificate Management =~~

	This document describes certificate management for OpenVPN.		This document describes certificate management for OpenVPN.

Line 14:		Line 12:
	cd /etc/openvpn/server/easy-rsa/		cd /etc/openvpn/server/easy-rsa/

	= Build a new CA (only needed once) =		=== Build a new CA (only needed once) ===
	./easyrsa build-ca		./easyrsa build-ca

	= Generate Diffie-Hellman parameters (only needed once) =		== Generate Diffie-Hellman parameters (only needed once) ==
	./easyrsa gen-dh		./easyrsa gen-dh

	= Build server certificate (already done) =		== Build server certificate (already done) ==
	./easyrsa build-server-full server nopass		./easyrsa build-server-full server nopass

	= Build client certificate =		== Build client certificate ==
	./easyrsa build-client-full clientname nopass		./easyrsa build-client-full clientname nopass

	= Revoke a certificate =		== Revoke a certificate ==
	./easyrsa revoke clientname		./easyrsa revoke clientname

	= Generate/update CRL =		== Generate/update CRL ==
	./easyrsa gen-crl		./easyrsa gen-crl

	= Show certificate details =		== Show certificate details ==
	./easyrsa show-cert clientname		./easyrsa show-cert clientname

	= List all certificates =		== List all certificates ==
	ls -la pki/issued/		ls -la pki/issued/
	</pre>		</pre>
Line 61:		Line 59:
	cd /etc/openvpn/server/easy-rsa/		cd /etc/openvpn/server/easy-rsa/

	= View certificate details =		=== View certificate details ===
	openssl x509 -in pki/issued/clientname.crt -noout -dates		openssl x509 -in pki/issued/clientname.crt -noout -dates

	= Or use Easy-RSA =		== Or use Easy-RSA ==
	./easyrsa show-cert clientname \| grep -i "not after"		./easyrsa show-cert clientname \| grep -i "not after"
	</pre>		</pre>
Line 72:		Line 70:
	If a certificate is about to expire or has expired:		If a certificate is about to expire or has expired:

	= '''Revoke the old certificate''' (if expired): =		=== '''Revoke the old certificate''' (if expired): ===
	<pre class="lang-bash">		<pre class="lang-bash">
	cd /etc/openvpn/server/easy-rsa/		cd /etc/openvpn/server/easy-rsa/
Line 80:		Line 78:
	</pre>		</pre>

	= '''Generate a new certificate''': =		== '''Generate a new certificate''': ==
	<pre class="lang-bash">		<pre class="lang-bash">
	./easyrsa build-client-full clientname nopass		./easyrsa build-client-full clientname nopass
	</pre>		</pre>

	= '''Update the .ovpn file''' with the new certificate: =		== '''Update the .ovpn file''' with the new certificate: ==
	<pre class="lang-bash">		<pre class="lang-bash">
	# Extract new certificate		=== Extract new certificate ===
	cat pki/issued/clientname.crt		cat pki/issued/clientname.crt

	# Update the <cert> section in the .ovpn file		=== Update the <cert> section in the .ovpn file ===
	nano /root/clientname.ovpn		nano /root/clientname.ovpn
	</pre>		</pre>

	= '''Distribute the updated .ovpn file''' to the client =		== '''Distribute the updated .ovpn file''' to the client ==

	= '''Restart OpenVPN''': =		== '''Restart OpenVPN''': ==
	<pre class="lang-bash">		<pre class="lang-bash">
	systemctl restart openvpn		systemctl restart openvpn
Line 110:		Line 108:

	<pre class="lang-bash">		<pre class="lang-bash">
	= Backup server configuration and certificates =		==== Backup server configuration and certificates ====
	tar -czf openvpn-backup-$(date +%Y%m%d).tar.gz \		tar -czf openvpn-backup-$(date +%Y%m%d).tar.gz \
	/etc/openvpn/server/ \		/etc/openvpn/server/ \
Line 119:		Line 117:
	=== Restore from Backup ===		=== Restore from Backup ===

	= Extract backup: =		==== Extract backup: ====
	<pre class="lang-bash">		<pre class="lang-bash">
	tar -xzf openvpn-backup-YYYYMMDD.tar.gz -C /		tar -xzf openvpn-backup-YYYYMMDD.tar.gz -C /
	</pre>		</pre>

	= Verify file permissions: =		== Verify file permissions: ==
	<pre class="lang-bash">		<pre class="lang-bash">
	chmod 600 /etc/openvpn/server/''.key		chmod 600 /etc/openvpn/server/''.key
Line 130:		Line 128:
	</pre>		</pre>

	= Restart OpenVPN: =		== Restart OpenVPN: ==
	<pre class="lang-bash">		<pre class="lang-bash">
	systemctl restart openvpn		systemctl restart openvpn

Josh: Minor update - troubleshooting guide: OpenVPN Certificate Management (10 sections)

2026-01-01T13:28:33Z

Minor update - troubleshooting guide: OpenVPN Certificate Management (10 sections)

← Older revision		Revision as of 13:28, 1 January 2026
Line 127:		Line 127:
	<pre class="lang-bash">		<pre class="lang-bash">
	chmod 600 /etc/openvpn/server/''.key		chmod 600 /etc/openvpn/server/''.key
	chmod 644 /etc/openvpn/server/''.crt		chmod 644 /etc/openvpn/server/*.crt
	</pre>		</pre>

Line 137:		Line 137:
	== Related Documentation ==		== Related Documentation ==

	'' [User Management](user-management.md) - Managing users and certificates		* [User Management](user-management.md) - Managing users and certificates
	'' [Server Configuration](server-configuration.md) - Server setup
	'' [[Documentation:Index\|Troubleshooting]] - Certificate troubleshooting		* [Server Configuration](server-configuration.md) - Server setup

			* [[Documentation:Index\|Troubleshooting]] - Certificate troubleshooting

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/OpenVPN]]		[[Category:Documentation/OpenVPN]]

Josh: Added troubleshooting guide: OpenVPN Certificate Management

2026-01-01T13:16:14Z

Added troubleshooting guide: OpenVPN Certificate Management

New page

= OpenVPN Certificate Management =

This document describes certificate management for OpenVPN.

== Certificate Authority ==

The server uses Easy-RSA 3 for certificate management. The Easy-RSA directory is located at <code>/etc/openvpn/server/easy-rsa/</code>.

== Easy-RSA Commands Reference ==

Common Easy-RSA commands:

<pre class="lang-bash">
cd /etc/openvpn/server/easy-rsa/

= Build a new CA (only needed once) =
./easyrsa build-ca

= Generate Diffie-Hellman parameters (only needed once) =
./easyrsa gen-dh

= Build server certificate (already done) =
./easyrsa build-server-full server nopass

= Build client certificate =
./easyrsa build-client-full clientname nopass

= Revoke a certificate =
./easyrsa revoke clientname

= Generate/update CRL =
./easyrsa gen-crl

= Show certificate details =
./easyrsa show-cert clientname

= List all certificates =
ls -la pki/issued/
</pre>

== Viewing All Certificates ==

To list all issued certificates:

<pre class="lang-bash">
cd /etc/openvpn/server/easy-rsa/
./easyrsa show-cert clientname
</pre>

To list all certificates in the PKI:

<pre class="lang-bash">
ls -la /etc/openvpn/server/easy-rsa/pki/issued/
</pre>

== Checking Certificate Expiration ==

To check when a certificate expires:

<pre class="lang-bash">
cd /etc/openvpn/server/easy-rsa/

= View certificate details =
openssl x509 -in pki/issued/clientname.crt -noout -dates

= Or use Easy-RSA =
./easyrsa show-cert clientname | grep -i "not after"
</pre>

== Renewing an Expired Certificate ==

If a certificate is about to expire or has expired:

= '''Revoke the old certificate''' (if expired): =
<pre class="lang-bash">
cd /etc/openvpn/server/easy-rsa/
./easyrsa revoke clientname
./easyrsa gen-crl
cp pki/crl.pem /etc/openvpn/server/crl.pem
</pre>

= '''Generate a new certificate''': =
<pre class="lang-bash">
./easyrsa build-client-full clientname nopass
</pre>

= '''Update the .ovpn file''' with the new certificate: =
<pre class="lang-bash">
# Extract new certificate
cat pki/issued/clientname.crt

# Update the <cert> section in the .ovpn file
nano /root/clientname.ovpn
</pre>

= '''Distribute the updated .ovpn file''' to the client =

= '''Restart OpenVPN''': =
<pre class="lang-bash">
systemctl restart openvpn
</pre>

== Certificate Revocation ==

See [user-management.md#revoking-a-user-certificate User Management] for details on revoking certificates.

== Backup and Recovery ==

=== Backup Important Files ===

<pre class="lang-bash">
= Backup server configuration and certificates =
tar -czf openvpn-backup-$(date +%Y%m%d).tar.gz \
/etc/openvpn/server/ \
/etc/openvpn/ccd/ \
/root/''.ovpn
</pre>

=== Restore from Backup ===

= Extract backup: =
<pre class="lang-bash">
tar -xzf openvpn-backup-YYYYMMDD.tar.gz -C /
</pre>

= Verify file permissions: =
<pre class="lang-bash">
chmod 600 /etc/openvpn/server/''.key
chmod 644 /etc/openvpn/server/''.crt
</pre>

= Restart OpenVPN: =
<pre class="lang-bash">
systemctl restart openvpn
</pre>

== Related Documentation ==

'' [User Management](user-management.md) - Managing users and certificates
'' [Server Configuration](server-configuration.md) - Server setup
'' [[Documentation:Index|Troubleshooting]] - Certificate troubleshooting

[[Category:Documentation]]
[[Category:Documentation/OpenVPN]]