701
回編集
差分
ページの作成:「== VPNサーバー == <syntaxhighlight lang="bash">pacman -S openvpn</syntaxhighlight> == 認証局サーバー == <syntaxhighlight lang="bash">pacman -S easy-rsa</synta…」
== VPNサーバー ==
<syntaxhighlight lang="bash">pacman -S openvpn</syntaxhighlight>
== 認証局サーバー ==
<syntaxhighlight lang="bash">pacman -S easy-rsa</syntaxhighlight>
<syntaxhighlight lang="bash">cd /etc/easy-rsa
easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/easy-rsa/pki
easyrsa build-ca
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus (2 primes)
...........................+++++
.....................................+++++
e is 65537 (0x010001)
Can't load /etc/easy-rsa/pki/.rnd into RNG
139748243150080:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:xxxxxxxx
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/easy-rsa/pki/ca.crt</syntaxhighlight>
CAの公開鍵をVPNサーバーに移行
<syntaxhighlight lang="bash">cp /etc/easy-rsa/pki/ca.crt /tmp
chown foo /tmp/ca.crt
scp /tmp/ca.crt foo@hostname-of-openvpn-server:/tmp</syntaxhighlight>
== VPNサーバー ==
<syntaxhighlight lang="bash">mv /tmp/ca.crt /etc/openvpn/server/
chown root:root /etc/openvpn/server/ca.crt</syntaxhighlight>
<syntaxhighlight lang="bash">pacman -S easy-rsa</syntaxhighlight>
<syntaxhighlight lang="bash">cd /etc/easy-rsa
easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/easy-rsa/pki
easyrsa gen-req ［サーバー名？］ nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/servername.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [servername]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/servername.req
key: /etc/easy-rsa/pki/private/servername.key
cp /etc/easy-rsa/pki/private/servername.key /etc/openvpn/server/</syntaxhighlight>
<syntaxhighlight lang="bash">openssl dhparam -out /etc/openvpn/server/dh.pem 2048</syntaxhighlight>
<syntaxhighlight lang="bash">openvpn --genkey --secret /etc/openvpn/server/ta.key</syntaxhighlight>
クライアントファイルの作成<br/>
初期化してなかったら…
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa init-pki</syntaxhighlight>
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa gen-req client1 nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/client1.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [client1]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/client1.req
key: /etc/easy-rsa/pki/private/client1.key</syntaxhighlight>
<syntaxhighlight lang="bash"># cp /etc/easy-rsa/pki/reqs/*.req /tmp
# chown foo /tmp/*.req
$ scp /tmp/*.req foo@hostname-of-CA:/tmp</syntaxhighlight>
== 認証局サーバー ==
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa import-req /tmp/servername.req servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: servername
You may now use this name to perform signing operations on this request.
# easyrsa import-req /tmp/client1.req client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: client1
You may now use this name to perform signing operations on this request.
# easyrsa sign-req server servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 1080 days:
subject=
commonName = xxxxxxxx
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'xxxxxxxx'
Certificate is to be certified until Dec 9 05:16:12 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/servername.crt
# easyrsa sign-req client client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 1080 days:
subject=
commonName = yyyyyyyy
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'yyyyyyyy'
Certificate is to be certified until Dec 9 05:17:51 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/client1.crt</syntaxhighlight>
認証局からVPNサーバーとクライアントに返却
<syntaxhighlight lang="bash"># cp /etc/easy-rsa/pki/issued/*.crt /tmp
# chown foo /tmp/*.crt
$ scp /tmp/*.crt foo@hostname-of-openvpn_server:/tmp</syntaxhighlight>
== VPNサーバー ==
<syntaxhighlight lang="bash"># mv /tmp/servername.crt /etc/openvpn/server/
# chown root:root /etc/openvpn/server/servername.crt</syntaxhighlight>
== VPNクライアント ==
ぶっちゃけどこでも構わない
<syntaxhighlight lang="bash"># mkdir /etc/easy-rsa/pki/signed
# mv /tmp/client1.crt /etc/easy-rsa/pki/signed</syntaxhighlight>
<syntaxhighlight lang="bash">pacman -S openvpn</syntaxhighlight>
== 認証局サーバー ==
<syntaxhighlight lang="bash">pacman -S easy-rsa</syntaxhighlight>
<syntaxhighlight lang="bash">cd /etc/easy-rsa
easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/easy-rsa/pki
easyrsa build-ca
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus (2 primes)
...........................+++++
.....................................+++++
e is 65537 (0x010001)
Can't load /etc/easy-rsa/pki/.rnd into RNG
139748243150080:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:xxxxxxxx
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/easy-rsa/pki/ca.crt</syntaxhighlight>
CAの公開鍵をVPNサーバーに移行
<syntaxhighlight lang="bash">cp /etc/easy-rsa/pki/ca.crt /tmp
chown foo /tmp/ca.crt
scp /tmp/ca.crt foo@hostname-of-openvpn-server:/tmp</syntaxhighlight>
== VPNサーバー ==
<syntaxhighlight lang="bash">mv /tmp/ca.crt /etc/openvpn/server/
chown root:root /etc/openvpn/server/ca.crt</syntaxhighlight>
<syntaxhighlight lang="bash">pacman -S easy-rsa</syntaxhighlight>
<syntaxhighlight lang="bash">cd /etc/easy-rsa
easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/easy-rsa/pki
easyrsa gen-req ［サーバー名？］ nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/servername.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [servername]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/servername.req
key: /etc/easy-rsa/pki/private/servername.key
cp /etc/easy-rsa/pki/private/servername.key /etc/openvpn/server/</syntaxhighlight>
<syntaxhighlight lang="bash">openssl dhparam -out /etc/openvpn/server/dh.pem 2048</syntaxhighlight>
<syntaxhighlight lang="bash">openvpn --genkey --secret /etc/openvpn/server/ta.key</syntaxhighlight>
クライアントファイルの作成<br/>
初期化してなかったら…
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa init-pki</syntaxhighlight>
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa gen-req client1 nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/client1.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [client1]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/client1.req
key: /etc/easy-rsa/pki/private/client1.key</syntaxhighlight>
<syntaxhighlight lang="bash"># cp /etc/easy-rsa/pki/reqs/*.req /tmp
# chown foo /tmp/*.req
$ scp /tmp/*.req foo@hostname-of-CA:/tmp</syntaxhighlight>
== 認証局サーバー ==
<syntaxhighlight lang="bash"># cd /etc/easy-rsa
# easyrsa import-req /tmp/servername.req servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: servername
You may now use this name to perform signing operations on this request.
# easyrsa import-req /tmp/client1.req client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: client1
You may now use this name to perform signing operations on this request.
# easyrsa sign-req server servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 1080 days:
subject=
commonName = xxxxxxxx
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'xxxxxxxx'
Certificate is to be certified until Dec 9 05:16:12 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/servername.crt
# easyrsa sign-req client client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 1080 days:
subject=
commonName = yyyyyyyy
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'yyyyyyyy'
Certificate is to be certified until Dec 9 05:17:51 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/client1.crt</syntaxhighlight>
認証局からVPNサーバーとクライアントに返却
<syntaxhighlight lang="bash"># cp /etc/easy-rsa/pki/issued/*.crt /tmp
# chown foo /tmp/*.crt
$ scp /tmp/*.crt foo@hostname-of-openvpn_server:/tmp</syntaxhighlight>
== VPNサーバー ==
<syntaxhighlight lang="bash"># mv /tmp/servername.crt /etc/openvpn/server/
# chown root:root /etc/openvpn/server/servername.crt</syntaxhighlight>
== VPNクライアント ==
ぶっちゃけどこでも構わない
<syntaxhighlight lang="bash"># mkdir /etc/easy-rsa/pki/signed
# mv /tmp/client1.crt /etc/easy-rsa/pki/signed</syntaxhighlight>