OpenVPN with smart cards / crypto tokens HOWTO Introduction ...

OpenVPN with smart cards / crypto tokens HOWTOexport KEY_ORG="Fort-Funston"export KEY_EMAIL="me@myhost.mydomain"Note that we are using 2048 bit keys.By default, all keys will be generated in /etc/openvpn/easy-rsa/keys folder.Install your settings in OpenSSL configuration:source ./varStep 3: clean previous configurationsWarning: this will remove the key directory, including previous CAs and keys.Don't clean your configuration unless you know precisely what you are doing../clean-allStep 4: create a DH keyCreate a shared DH key used to secure key hashing:Warning: on slow computers, this can take 15 minutes../build-dhThis creates a file name dh2048.pem in /etc/openvpn/easy-rsa/keysStep 5: create CAGenerate the Certificate Authority (CA):pkitool --init-caTwo files are created in keys folder:ca.key: CA private key.ca.crt: CA X.509 certificate.Step 6: create server certificateGenerate server key (Moon):$ pkitool --server serverThree files are generated:server.key: server RSA private key.server.crt: Server X.509 certificate.server.csr: Server signing request (no need to keep it).Step 7: create client certificate on diskGenerate client key (Road warrior).The pkcs12 file includes all information, for later import to smartcard.pkitool --pkcs12 clientEnter your password twice to secure the pkcs12 file.Four files are generated:client.key: client RSA private key.client.crt: client X.509 certificate.client.csr: client signing request (no need to keep it).client.p12: PKCS#12 file including RSA private key, X.509 certificate and CA authorityStep 8: transfer client certificates to smartcardNow we need to transfer the PKCS#12 file to the smartcard.All steps are described in the Quickstarter Guide.You may need to:Erase and format the smartcard, adapt PIN code and label.Waring: you will loose all content:$ pkcs15-init -E$ pkcs15-init --create-pkcs15 --profile pkcs15+onepin --use-default-transport-key --pin 0000 --puk 111111 --label "François Pérou"Copyright GOOZE 2010-2011 http://www.gooze.eu 4 / 8