Zde si musíte zeditovat proměnné podle Vašeho počítače. Popis co co znamená je přiložen v kódu.
# Uložení adresáře, kde máme uloženy skripty
export D=/root/openvpn/20/openvpn/tmp/easy-rsa
# Cesta ke konfiračnímu souboru SSL knihovny
export KEY_CONFIG=$D/openssl.cnf
# Adresář, kam se budou nahrávat vytvořené klíče
# Před vytvořením bude vždy smazán a znovu poté vytvořen
export KEY_DIR=$D/keys
# Počet bitů pro Diffie-Hellmann
export KEY_SIZE=1024
# Zde můžeme vypsat defaultní hodnoty, které se pak při vytváření certifikátu budou samy nabízet
export KEY_COUNTRY=CS
export KEY_PROVINCE=NA
export KEY_CITY=Pilsen
export KEY_ORG="OpenVPN-TEST"
export KEY_EMAIL="admin@zcu.cz"
#!/bin/bash
#
# Inicializace $KEY_DIR adresáře
#
d=$KEY_DIR
if test $d; then
rm -rf $d
mkdir $d && \
chmod go-rwx $d && \
touch $d/index.txt && \
echo 01 >$d/serial
else
echo you must define KEY_DIR
fi
#!/bin/bash
#
# Vytvoření certikátů
#
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl req -days 3650 -nodes -new -x509 -keyout ca.key -out ca.crt -config $KEY_CONFIG && \
chmod 0600 ca.key
#Vysvětlení co co znamená
#req - žádost o vydání certifikátu
#-days - počet dní platnosti certifikatu/klíče
#-nodes - v případě že vytvoříme klíč nebude chráněn heslem
#-new - vytvoření žádosti o certifikát, uživatel bude vyzván k vyplnění relevantních polí
#-x509 - certifikát bude podepsán sám sebou
#-keyout - zapsání nového klíče do souboru
#-out - zapsání nového certifikátu do souboru
#-config - použití konfiguračního souboru
else
echo you must define KEY_DIR
fi
ca.crt
ca.key
#!/bin/bash
#
# Build Diffie-Hellman parameters for the server side
# of an SSL/TLS connection.
#
if test $KEY_DIR; then
openssl dhparam -out ${KEY_DIR}/dh${KEY_SIZE}.pem ${KEY_SIZE}
else
echo you must define KEY_DIR
fi
#!/bin/bash
#
# Build a certificate signing request and private key. Use this
# when your root certificate and key is not available locally.
#
if test $# -ne 1; then
echo "usage: build-req
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -config $KEY_CONFIG
else
echo you must define KEY_DIR
fi
#!/bin/bash
#
# Sign a certificate signing request (a .csr file)
# with a local root certificate and key.
#
if test $# -ne 1; then
echo "usage: sign-req
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG
else
echo you must define KEY_DIR
fi
#!/bin/bash
#
# Make a certificate/private key pair using a locally generated
# root certificate.
#
if test $# -ne 1; then
echo "usage: build-key
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -config $KEY_CONFIG && \
openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG && \
chmod 0600 $1.key
else
echo you must define KEY_DIR
fi
nebo
#!/bin/bash
#
# Similar to build-key, but protect the private key
# with a password.
#
if test $# -ne 1; then
echo "usage: build-key-pass
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl req -days 3650 -new -keyout $1.key -out $1.csr -config $KEY_CONFIG && \
openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG && \
chmod 0600 $1.key
else
echo you must define KEY_DIR
fi
nebo
Certifikát pro Váš server z bezpečnostních důvodů generujte výše uvedeným skriptem.Zabraňuje tzv. Man-in-the-Middle útoku. Zabraňuje připojení klientů k serverům, které nemaji ve svém certifikátu uvedeno nsCertType=server
#!/bin/bash
#
# Make a certificate/private key pair using a locally generated
# root certificate.
#
# Explicitly set nsCertType to server using the "server"
# extension in the openssl.cnf file.
if test $# -ne 1; then
echo "usage: build-key
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR && \
openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -extensions server -config $KEY_CONFIG && \
openssl ca -days 3650 -out $1.crt -in $1.csr -extensions server -config $KEY_CONFIG
else
echo you must define KEY_DIR
fi
Proto jen ve zkratce
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.
set HOME=%ProgramFiles%\OpenVPN
set KEY_CONFIG=%HOME%\openssl.cnf
rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=%HOME%\CA
rem Increase this to 2048 if you
rem are paranoid. If you do increase,
rem make sure you build OpenVPN with
rem pthread support, so you don't incur
rem any performance penalty.
set KEY_SIZE=1024
rem These are the default values for fields
rem which will be placed in the certificate.
set KEY_COUNTRY=Cs
set KEY_PROVINCE=Czech
set KEY_CITY=Pilsen
set KEY_ORG="POkus"
set KEY_EMAIL=zcudotcz
@echo off
rem move to the HOME directory specified in VARS script
cd %HOME%
rem set a temporary KEY_DIR variable
set d=%KEY_DIR%
rem delete the KEY_DIR and any subdirs quietly
rmdir /S /Q "%d%"
rem make a new KEY_DIR
mkdir "%d%"
rem copy in a fesh index file so we begin with an empty database
copy index.txt.start "%d%\index.txt"
rem copy in a fresh serial file so we begin generating keys at index 01
copy serial.start "%d%\serial."
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.
set HOME=%ProgramFiles%\OpenVPN
set KEY_CONFIG=%HOME%\openssl.cnf
rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=%HOME%\CA
rem Increase this to 2048 if you
rem are paranoid. If you do increase,
rem make sure you build OpenVPN with
rem pthread support, so you don't incur
rem any performance penalty.
set KEY_SIZE=1024
rem These are the default values for fields
rem which will be placed in the certificate.
set KEY_COUNTRY=Cs
set KEY_PROVINCE=Czech
set KEY_CITY=Pilsen
set KEY_ORG="POkus"
set KEY_EMAIL=zcudotcz
@echo off
cd %HOME%
rem build a cert authority valid for ten years, starting now
openssl req -days 3650 -nodes -new -x509 -keyout "%KEY_DIR%\ca.key" -out "%KEY_DIR%\ca.crt" -config "%KEY_CONFIG%"
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.
set HOME=%ProgramFiles%\OpenVPN
set KEY_CONFIG=%HOME%\openssl.cnf
rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=%HOME%\CA
rem Increase this to 2048 if you
rem are paranoid. If you do increase,
rem make sure you build OpenVPN with
rem pthread support, so you don't incur
rem any performance penalty.
set KEY_SIZE=1024
rem These are the default values for fields
rem which will be placed in the certificate.
set KEY_COUNTRY=Cs
set KEY_PROVINCE=Czech
set KEY_CITY=Pilsen
set KEY_ORG="POkus"
set KEY_EMAIL=zcudotcz
@echo off
cd %HOME%
rem build a dh file for the server side
openssl dhparam -out "%KEY_DIR%\dh%KEY_SIZE%.pem" %KEY_SIZE%
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.
set HOME=%ProgramFiles%\OpenVPN
set KEY_CONFIG=%HOME%\openssl.cnf
rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=%HOME%\CA
rem Increase this to 2048 if you
rem are paranoid. If you do increase,
rem make sure you build OpenVPN with
rem pthread support, so you don't incur
rem any performance penalty.
set KEY_SIZE=1024
rem These are the default values for fields
rem which will be placed in the certificate.
set KEY_COUNTRY=Cs
set KEY_PROVINCE=Czech
set KEY_CITY=Pilsen
set KEY_ORG="POkus"
set KEY_EMAIL=zcudotcz
@echo off
cd %HOME%
rem build a request for a cert that will be valid for ten years
openssl req -days 3650 -nodes -new -keyout "%KEY_DIR%\%1.key" -out "%KEY_DIR%\%1.csr" -config "%KEY_CONFIG%"
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out "%KEY_DIR%\%1.crt" -in "%KEY_DIR%\%1.csr" -extensions server -config "%KEY_CONFIG%"
rem delete any .old files created in this process, to avoid future file creation errors
del /Q "%KEY_DIR%"\*.old
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.
set HOME=%ProgramFiles%\OpenVPN
set KEY_CONFIG=%HOME%\openssl.cnf
rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=%HOME%\CA
rem Increase this to 2048 if you
rem are paranoid. If you do increase,
rem make sure you build OpenVPN with
rem pthread support, so you don't incur
rem any performance penalty.
set KEY_SIZE=1024
rem These are the default values for fields
rem which will be placed in the certificate.
set KEY_COUNTRY=Cs
set KEY_PROVINCE=Czech
set KEY_CITY=Pilsen
set KEY_ORG="POkus"
set KEY_EMAIL=zcudotcz
@echo off
cd %HOME%
rem build a request for a cert that will be valid for ten years
openssl req -days 3650 -nodes -new -keyout "%KEY_DIR%\%1.key" -out "%KEY_DIR%\%1.csr" -config "%KEY_CONFIG%"
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out "%KEY_DIR%\%1.crt" -in "%KEY_DIR%\%1.csr" -config "%KEY_CONFIG%"
rem delete any .old files created in this process, to avoid future file creation errors
del /Q %KEY_DIR%\*.old