Openvpn Generate Client Keys New Command Prompt

admin 07.12.2020

Reading Time: 8minutes

Easy Windows Guide. This page contains a no-frills guide to getting OpenVPN up and running on a Windows server and client(s). For a more detailed understanding of setting up OpenVPN and its advanced features, see the HOWTO page. Note that the server and client clocks need to be roughly in sync or certificates might not work properly. Generate the master Certificate Authority (CA) certificate & key. In this section we will generate a master CA certificate/key, a server certificate/key, and certificates/keys for 3 separate clients. How to generate openvpn client key dynamically with php and pass variables to shell command? Save the above bash script as new-openvpn-client.sh and give it. Looking to learn everything you need to know about Access Server command line interface tools? Get started with this introduction here. OpenVPN Cloud beta closes in days. And the command prompt is not a forgiving environment. Managing user and group properties from command line; Create connection profiles and Connect Client installers. Dec 30, 2019 The OpenVPN Connect Clients. The OpenVPN client is also an important part of the OpenVPN software. This application allows users to link to the VPN server directly in one of three ways. The VPN Client also offers the ability to download the user’s configuration file, which can be duplicated to other OpenVPN clients. The three options are.

What is OpenVPN?

As noted previously in our OpenVPN article, OpenVPN is an open-source Windows software package used to create a secure, site-to-site VPN connection that provides remote access between two locations. OpenVPN consists of three parts:

The OpenVPN-AS Server
The Admin Web Interface/Admin GUI
The Connection Clients

The OpenVPN Server

The OpenVPN server is the principal element of the OpenVPN-AS Server and manages the main functions on the backend. Some of the functionality that is handled in the admin interface includes tunneling, routing, encryption, user management, authentication, and many other features. The OpenVPN server also consists of a WebGUI, which assists with control in several of the fundamental components of the software.

The Main WebGUI Administrative Interface

The main web-based GUI allows for the uncomplicated handling of the OpenVPN server elements. In the WebGUI, an admin can check routing options, privileges, network configurations, user validation, and other parameters. By default, an administrator can connect to the GUIWeb gateway by browsing to https://serverip:943/admin

The OpenVPN Connect Clients

The OpenVPN client is also an important part of the OpenVPN software. This application allows users to link to the VPN server directly in one of three ways. The VPN Client also offers the ability to download the user’s configuration file, which can be duplicated to other OpenVPN clients. The three options are:

Browser Connect Client – This is the browser-based connection tool for openvpn. The web address for users is https://serverip:943
OpenVPN Connect Client (Mac) – Simplistic single connection client
OpenVPN Connect Client (Linux/Windows) – This is the OpenVPN client (which is different from the main openvpn-as program). This software requires a configuration file to work correctly.

Install OpenVPN

On a Windows server, we begin by downloading the Windows installer from here and then running it on our Windows server.

Certs and Keys

Prerequisites

Browse to the

folder using the administrative command prompt:

Open the Start menu
Type in “cmd”
Next, right click on “Command Prompt” and select “Run as Administrator.”
Then, right click the menu item “Command Prompt”
On the “User Account Control” pop up window, click “Yes”

Navigate to this folder.

And now, we can start the OpenVPN configuration:

Only run init-config once during installation.

Next, we open the “vars.bat” file in a text editor.

And edit the subsequent lines switching “US”, “CA,” etc. with your business’s data.

We can then save the file and exit Notepad.

The KEY_CN and KEY_NAME fields will be unique for each build request.

The KEY_CN and KEY_NAME settings refer to the common name field and the name of the certificate.

The KEY_OU setting refers to an “Organizational Unit” and can be set to whatever if there isn’t a requirement for it.

The PKCS11_ values refer to settings used for Hardware Security Modules and Smart Cards if you use them.

Next, we will run the following commands.

Building Certificates and Keys

In order to create the Certificate Authority (CA) certificate and key, we need to run.

This will prompt you to enter your country, state, and city. These options will also have default values, which appear within brackets.
For the “Common Name,” a beneficial choice is to choose a unique name to distinguish your company.

Next, we initiate the server’s certificate and key using this command:

When prompted, enter the “Common Name” as “server”
When prompted to sign the certificate, enter “y”
When prompted to commit, enter “y”

Server Certificates and Keys:

Client Certificates and Keys

For each client that will be connecting to the server, we must choose a unique name to identify that user’s computer, such as “david-laptop” in the example below.

Next, when prompted, we enter the “Common Name” as the name you have chosen for the client’s cert/key.

We will repeat this step for every client computer that is going to connect to the VPN.

Now, we need to generate the “Diffie Hellman” parameters using the build-dh command. Wings of liberty key generator. This step is necessary in order to set up the encryption model.

Next, we will generate a shared secret key (which is required when using tls-auth)

Configuration Files

OpenVPN provides sample configuration data which can easily be found using the start menu:
Start Menu -> All Programs -> OpenVPN -> OpenVPN Sample Configuration Files

Server Config File

Now, let’s copy the sample “server configuration” file over to the easy-rsa folder. Here is the command and its output:

Next, we will need to edit the server.ovpn file.

Now, locate the following lines within the file:

Command Prompt Shortcut Keys

And edit them as follows:

Finally, save and close the file.

Client Config Files

The client file modification is very similar to the server configuration changes we made earlier. Let’s copy the sample server configuration file to the easy-rsa folder with the client’s Common Name as the file name. (Remember, each client will need to have a unique filename).

Next, we will edit the client’s config file.

We will locate the following settings in the file and edit them as follows:

Observe that the name of the client certificate and related key files rely upon the “Common Name” of each client.

We can also include the ca, cert, and key content in the client file. We will have to copy the file content from inside the tags:

<ca></ca>
<cert></cert>
<key></key>

Next, we will edit the line “my-server-1“, replacing it with the server’s public IP Address or Domain Name.

Finally, we can save and close the file.

Copying the Client and Server Files to Their Pertinent Directories

Now we can copy these files from C:Program FilesOpenVPNeasy-rsakeys to C:Program FilesOpenVPNconfig on the server using the robocopy command:

ca.crt
ta.key
dh2048.pem
server.crt
server.key
server.ovpn

The space at the end of the path in each string is important.

Command Prompt Keys

Now, we can copy the following files from C:Program FilesOpenVPNeasy-rsakeys on the server to C:Program FilesOpenVPNconfig for each client that will be using the VPN (e.g., david-laptop, in this example)

ca.crt
ta.key
david-laptop.crt
david-laptop.key
david-laptop.ovpn

Starting OpenVPN

Next, on both the server and the client, we need to run OpenVPN from:
Start Menu -> All Programs -> OpenVPN -> OpenVPN GUI

Now, let’s double click the icon which appears in the system tray to start the connection. The subsequent dialog box will close upon an effective start.

Final Thoughts

Firewall Settings

If you have any connection difficulties, ensure you set up a rule on the server’s firewall allowing incoming UDP traffic on port 1194. (Win+R “wf.msc”)

Running OpenVPN as a Service

We can also run OpenVPN as a service, which will allow:

OpenVPN to be run from a non-administrative account.
OpenVPN to be started automatically on the systems startup. This is the preferred method to use on a server, as well as any clients which will be continually connecting to the server.
To run the Windows Service administrative tool:
(Press Windows Key+R)
Type in “services.msc” and press ‘Enter’ to start the services.msc tool. Next, locate the OpenVPN service, and reset its Startup Type to “automatic.” Optionally, you can start the service now if desired.

Security Tips