mkdir -p /etc/openvpn/easy-rsa/keys

Next, we will copy the certificate generation scripts from their default location to our OpenVPN folder.

cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa

We will go to the easy-rsa directory and source the variables.

cd /etc/openvpn/easy-rsa

source ./vars

Then we will clean all the existing keys & certificates (if any) and generate the new certificate authority.

./clean-all

When building the certificate authority we will be asked for different information such as the country, organization and department. You can fill in your information or to leave it as it is you can just press enter.

./build-ca

The keys and certificates for the OpenVPN server will be generated next. The identical questions from the previous command will be asked to you once more; you can choose to answer them or not by simply hitting the enter key. We will generate the keys and certificates using the server’s filename by running the command below. Once your data has been entered, you will be prompted to sign the certificate; click “y” to confirm.

./build-key-server server

We will also need to create a Diffie-Hellman file. Creation of this file will depends on the length of the key. For this default we will use 2048 bit key but you can always change it by editing the vars file in the easy-rsa folder. Key generation may take a minute or two.

./build-dh

Since this guide is all about OpenVPN authentication using client certificate we will also need to generate a certificate for our client. Without this certificate, our client will not be able to login to the OpenVPN server. Always remember to keep this client certificate safe with you at all times, you should never distribute your own certificate to others. If you want others to use your OpenVPN server you should create a client certificate for them by following the below command. For this guide we will create a certificate for “John”.

./build-key john

john.key will be the filename of the client key & certificate.

For the above commands we will have the following keys and certificates in the folder /etc/openvpn/easy-rsa/keys

server.key
server.crt
john.key
john.crt
ca.crt
ca.key
dh2048.pem

You will need to download john.key, john.crt and ca.crt for use by the OpenVPN client.