How Keys Are Generated in Open Source VPNs (Primarily OpenVPN):OpenVPN, one of the most popular open-source VPNs, uses a Public Key Infrastructure (PKI) for authentication and encryption. The key generation process involves several steps:
1. Creating a Certificate Authority (CA):- Tthe Certificate Authority (CA) is a trusted entity that issues and verifies digital certificates for the VPN server and its clients. Tools like openssl or easy-rsa simplify CA operations.
- The process involves creating a CA private key (ca.key) and a self-signed CA certificate (ca.crt). The CA private key must be kept strictly secret, as it allows the signing of any other certificates.
- easy-rsa typically provides scripts for this, such as build-ca.
2. Generating a Key and Certificate Signing Request (CSR) for the VPN Server:- A private key (server.key) is generated on the VPN server.
- A Certificate Signing Request (server.csr) is created based on this key. The CSR contains information about the server (e.g., Common Name - the server’s domain name or IP address).
- easy-rsa provides scripts like build-server-full <servername> to simplify this process.
3. Signing the Server’s Certificate Signing Request with the CA:- The server’s CSR (server.csr) is signed with the CA’s private key (ca.key) and CA certificate (ca.crt).
- This creates the server certificate (server.crt), which verifies that the VPN server is who it claims to be.
- easy-rsa provides scripts like sign-server <servername> to simplify the signing process.
4. Generating a Key and Certificate Signing Request for Each VPN Client:- A unique private key (client.key) is generated for each VPN client.
- A Certificate Signing Request (client.csr) is created for each client based on their unique private key.
- easy-rsa provides scripts like build-client-full <clientname> to simplify this process.
5. Signing the Client’s Certificate Signing Request with the CA:- The client’s CSR (client.csr) is signed with the CA’s private key (ca.key) and CA certificate (ca.crt).
- This creates the client certificate (client.crt), which allows the client to authenticate with the VPN server.
- easy-rsa provides scripts like sign-client <clientname> to simplify the signing process.
6. Generating an HMAC Key (TLS Authentication):- This key is used to protect against Denial-of-Service (DoS) attacks and to enhance the security of the control channel.
- The HMAC key (ta.key) is created using the command openssl dhparam -out ta.key 2048.
7. Distributing Configuration Files and Keys to Clients:- Clients need to be provided with an OpenVPN configuration file (.ovpn), which contains information about the server (IP address, port), the protocols and encryption algorithms used, as well as the CA certificate (ca.crt), the client certificate (client.crt), the client’s private key (client.key), and, if necessary, the HMAC key (ta.key).