Вчера вечером все заработало, но я не в восторге от ovpn в MT. Там так много функций не поддерживаются и не задокументированы. Вот как я сгенерировал сертификаты:
```
ServerSide
root@voyage:~/ca# openssl req -new -x509 -newkey rsa:4096 -keyout CAkey.pem -out CA.crt -days 3650
Generating a 4096 bit RSA private key
.........................................................................................................................................................................................................++
.......................................++
writing new private key to 'CAkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:Test
Email Address []:test@test.de
root@voyage:~/ca#
```
```
root@voyage:~/ca# openssl genrsa -out serverkey.pem -aes128 4096 -days 3650
Generating RSA private key, 4096 bit long modulus
.......................................................++
.........................................................................................................................................................................++
e is 65537 (0x10001)
Enter pass phrase for serverkey.pem:
Verifying - Enter pass phrase for serverkey.pem:
root@voyage:~/ca#
```
```
root@voyage:~/ca# openssl rsa -in serverkey.pem -out serverkeyohnepass.pem
Enter pass phrase for serverkey.pem:
writing RSA key
root@voyage:~/ca#
```
```
root@voyage:~/ca# openssl req -new -key serverkey.pem -out serverreq.pem -nodes
Enter pass phrase for serverkey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:Test
Email Address []:test@test.de
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:12345678
An optional company name []:test
root@voyage:~/ca#
```
```
root@voyage:~/ca# echo 01 > serial
root@voyage:~/ca# touch index.txt
root@voyage:~/ca# openssl ca -in serverreq.pem -notext -out servercert.crt
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./CAkey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jan 4 19:14:43 2014 GMT
Not After : Jan 2 19:14:43 2024 GMT
Subject:
countryName = DE
stateOrProvinceName = Bayern
organizationName = test
organizationalUnitName = test
commonName = Test
emailAddress = test@test.de
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
60:3D:74:48:76:0E:72:0F:D9:DC:D7:F8:62:29:B0:18:AF:18:0B:F9
X509v3 Authority Key Identifier:
keyid:C4:04:D3:57:37:CD:E3:37:11:68:6B:CC:AC:46:27:72:60:BA:A6:EC
Certificate is to be certified until Jan 2 19:14:43 2024 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
root@voyage:~/ca# Clientside
root@voyage:~/ca# openssl genrsa -out clientkey.pem 4096
Generating RSA private key, 4096 bit long modulus
.............++
............................................................................................++
e is 65537 (0x10001)
root@voyage:~/ca#
```
```
root@voyage:~/ca# openssl req -new -key clientkey.pem -out clientreq.pem -nodes
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:DE
State or Province Name (full name) [Some-State]:Bayern
Locality Name (eg, city) []:teststadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:TestClient
Email Address []:test@test.de
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:12345678
An optional company name []:test
root@voyage:~/ca#
```
```
root@voyage:~/ca# openssl ca -in clientreq.pem -notext -out clientcert.crt
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./CAkey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 4 (0x2)
Validity
Not Before: Jan 4 19:31:05 2014 GMT
Not After : Jan 2 19:31:05 2024 GMT
Subject:
countryName = DE
stateOrProvinceName = Bayern
organizationName = test
organizationalUnitName = test
commonName = TestClient
emailAddress = test@test.de
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DC:D1:0C:1D:C1:EE:EE:B7:25:6A:FB:5A:09:A0:AD:0E:3F:E5:36:22
X509v3 Authority Key Identifier:
keyid:C4:04:D3:57:37:CD:E3:37:11:68:6B:CC:AC:46:27:72:60:BA:A6:EC
Certificate is to be certified until Jan 2 19:31:05 2024 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
root@voyage:~/ca#
```
Я сгенерировал сертификаты, но не в восторге от ovpn в MT. Там так много функций не поддерживаются и не задокументированы.
