Creating TLS-CRYPT-V2 Key with Easy-RSA 3 for OpenVPN

Creating TLS-CRYPT-V2 Key with Easy-RSA 3 for OpenVPN

In this article, we will guide you through the process of creating a TLS-CRYPT-V2 key using Easy-RSA 3 for OpenVPN. The TLS-CRYPT-V2 key provides an additional layer of security to your OpenVPN setup. Before we begin, it is assumed that you have already downloaded and installed Easy-RSA 3. If not, please download it from the official Easy-RSA GitHub repository.

Setting up the Easy-RSA Environment

To set up the Easy-RSA environment, follow these steps:

1. Open a terminal and navigate to the Easy-RSA directory.
2. Copy the vars.example file to a new file called vars.
3. Edit the vars file and update the fields as necessary, such as export KEY_COUNTRY, export KEY_PROVINCE, export KEY_CITY, export KEY_ORG, export KEY_EMAIL, and export KEY_CN.
4. Source the vars file by running the command source vars.

Initializing the PKI

To initialize the PKI, run the following command:

Building the Certificate Authority (CA)

To build the CA, follow these steps:

1. Build the CA by running the command ./easyrsa build-ca.
2. Enter the necessary information when prompted.

Generating the TLS-CRYPT-V2 Key

To generate the TLS-CRYPT-V2 key, follow these steps:

1. Generate a new Diffie-Hellman parameters file by running the command ./easyrsa gen-dh.
2. Generate the TLS-CRYPT-V2 key by running the command openvpn --genkey --secret ta.key.

Creating Server and Client Certificates

To create server and client certificates, follow these steps:

1. Create the server certificate by running the command ./easyrsa build-server-full server nopass.
2. Create the client certificate by running the command ./easyrsa build-client-full client1 nopass.

Signing the Certificates

To sign the certificates, follow these steps:

1. Sign the server certificate by running the command ./easyrsa sign-server server.
2. Sign the client certificate by running the command ./easyrsa sign-client client1.

Exporting the Certificates and Keys

To export the certificates and keys, run the following commands:

• Downloaded and installed Easy-RSA 3.
• Set up the Easy-RSA environment.
• Initialized the PKI.
• Built the Certificate Authority (CA).
• Generated the TLS-CRYPT-V2 key.
• Created server and client certificates.
• Signed the certificates.
• Exported the certificates and keys.

References

• Easy-RSA: https://github.com/OpenVPN/easy-rsa

• OpenVPN: https://openvpn.net/vpn-server-resources/how-to-set-up-an-openvpn-server-on-linux/