OpenSSL PKI for OpenVPN

# https://www.sysadmin.md/verbose-vpn-server-installation-using-openvpn-and-openssl.html

# Environment Variables
dir=./pki/
openssl_conf=./openssl.conf
ca_privkey=$dir/private/ca.key
ca_cert=$dir/certs/ca.crt
server_privkey=$dir/private/server.key
server_request=$dir/reqs/server.req
server_cert=$dir/certs/server.crt
client_privkey=$dir/private/client.key
client_request=$dir/reqs/client.req
client_cert=$dir/certs/client.crt
serial=$dir/serial
index=$dir/index.txt
ca_crl=$dir/crl

# Initialization
mkdir $dir
mkdir $dir/private/
mkdir $dir/certs/
mkdir $dir/reqs/
touch $index


# $openssl_conf:
    [ ca ]
    default_ca                              = CA_OpenVPN

    [ CA_OpenVPN ]
    dir                                     = ./pki
    certs                                   = $dir/certs
    crl_dir                                 = $dir/crls
    database                                = $dir/index.txt
    new_certs_dir                           = $certs
    certificate                             = $dir/certs/ca.crt
    serial                                  = $dir/serial
    crl                                     = $dir/crls/crl.pem
    private_key                             = $dir/private/ca.key
    RANDFILE                                = $dir/.rand
    x509_extensions                         = vpn_cert_ext
    default_days                            = 3650
    default_crl_days                        = 365
    default_md                              = sha256
    policy                                  = vpn_policy

    [ vpn_cert_ext ]
    basicConstraints                        = CA:FALSE

    [ vpn_policy ]
    organizationName                        = match
    organizationalUnitName                  = supplied
    commonName                              = supplied
    emailAddress                            = supplied

    [ req ]
    default_bits                            = 2048
    distinguished_name                      = req_vpn_dn
    x509_extensions                         = vpn_CA_cert_ext

    [ req_vpn_dn ]
    commonName                              = Common Name (eg. Linux machine)
    commonName_max                          = 64
    commonName_default                      = MyTestCA
    0.organizationName                      = Organization Name (eg. company)
    0.organizationName_default              = MyTestCA
    organizationalUnitName                  = Organizational Unit Name (eg, section)
    organizationalUnitName_default          = My Organizational Unit
    emailAddress                            = Email Address
    emailAddress_default                    = example@example.com

    [ vpn_CA_cert_ext ]
    basicConstraints                        = CA:TRUE


# Root CA Private Key
    # Generate CA Root Certificate and Private Key
    openssl req -new -x509 -nodes -keyout $ca_privkey -out $ca_cert -days 3650 -config $openssl_conf
    # Verify
        openssl rsa -noout -text -in $ca_privkey
        openssl x509 -noout -text -in $ca_cert



# Server Certificate
    # Generate Server Private Key and Certificate Signing Request
    openssl req -new -nodes -keyout $server_privkey -out $server_request -config $openssl_conf
    # Verify
        openssl rsa -noout -text -in $server_privkey
        openssl req -noout -text -in $server_request

    # Sign and Issue Server Certificate
    openssl rand -hex 16 > $serial
    openssl ca -in $server_request -batch -out $server_cert -config $openssl_conf
    # Verify
        openssl x509 -noout -text -in $server_cert


# Client Certificate
    # Generate Client Private Key and Certificate Signing Request
    openssl req -new -nodes -keyout $client_privkey -out $client_request -config $openssl_conf
    # Verify
        openssl rsa -noout -text -in $client_privkey
        openssl req -noout -text -in $client_request


    # Sign and Issue Client Certificate
    openssl rand -hex 16 > $serial
    openssl ca -in $client_request -batch -out $client_cert -config $openssl_conf
    # Verify
        openssl x509 -noout -text -in $client_cert


# crl
    # Generate crl
    openssl ca -gencrl -out $ca_crl -config $openssl_conf
    # Verify
        openssl crl -noout -text -in $ca_crl