[Openvpn-users] Intermediate CA howto?

[Jason]

All,

I've been using openvpn for a few years now with my own CA using the easy-rsa scripts. Things were good. Now I need to expand. I'd like to create an Intermediate CA so a remote site can issue their own certs, but they don't have access to my CA key.

I've dug around a bit, and haven't found much regarding what order to do things in. Obviously, it involves an existing CA (with keys/ dir), and ./build-inter and ./inherit-inter from the easy-rsa scripts.

I think I'm reading too much into the explanation given in ./inherit-inter. So, if you don't mind, I'm just going to post my interpretation of what I should be doing and see if anyone laughs. ;-)

Prerequisites:
- An established CA using easy-rsa with all keys in easy-rsa/keys
- Someone bugging you for the ability to create certs (not needed, but it helps)
- root access and access to the CA key file.

End-Goal:
- a new easy-rsa directory (called inter0/ in the example) with the absolute
bare minimum to create certs.

HOWTO Steps:

***@ubuntu:~$ sudo su

***@ubuntu:/home/jason# cd /path/to/easy-rsa

***@ubuntu:.../easy-rsa# source ./vars

***@ubuntu:.../easy-rsa# ./build-inter "inter0"

***@ubuntu:.../easy-rsa# mkdir -p ../inter0/keys

***@ubuntu:.../easy-rsa# cp * ../inter0/

***@ubuntu:.../easy-rsa# exit

***@ubuntu:.../easy-rsa# sudo su

***@ubuntu:.../easy-rsa# cd ../inter0

***@ubuntu:.../inter0# vim ./vars # change fields for ICA

***@ubuntu:.../inter0# source ./vars

***@ubuntu:.../inter0# ./inherit-inter ../easy-rsa/keys/ "inter0"

***@ubuntu:.../inter0# ./build-key-pass "test"


Questions:

Okay, the above appears to work. Can I just tar up inter0/ and securely transfer it to the remote site? It's ca.key is definitely different than mine in easy-rsa/keys/.

Also, what do I need to transfer to my vpn server in order to accept the client certs generated by inter0? Do I just append inter0/keys/ca.crt >>easy-rsa/keys/ca.crt ? Obviously on the vpn server...

Last, any nuances to maintaining the CRLs wrt intermediate CA certs?

Any pointers appreciated.

thx,

Jason.

[Jason]

Post by Jason
Also, what do I need to transfer to my vpn server in order to accept
the client certs generated by inter0? Do I just append
inter0/keys/ca.crt >>easy-rsa/keys/ca.crt ? Obviously on the vpn
server...

After a night's sleep, it looks a little clearer now. I think if I just put the inter0/keys/export-ca.crt on the server, then the server will recognize both my client certs, and the client certs issued by the ICA.

On the other side, clients only need to authenticate the server cert, which was generated by the CA. So can I get away with only shipping the CA's ca.crt? That way the ICA can't give clients the ability to connect to servers other than mine... Or am I overthinking this again?

Post by Jason
Last, any nuances to maintaining the CRLs wrt intermediate CA certs?

Looking at the code (easy-rsa/revoke-full) it seems written to handle ICA's. Does anyone have experience with this?

thx,

Jason.

[Jan Just Keijser]

Post by Jason

Post by Jason
Also, what do I need to transfer to my vpn server in order to accept
the client certs generated by inter0? Do I just append
inter0/keys/ca.crt >>easy-rsa/keys/ca.crt ? Obviously on the vpn
server...

After a night's sleep, it looks a little clearer now. I think if I just put the inter0/keys/export-ca.crt on the server, then the server will recognize both my client certs, and the client certs issued by the ICA.
On the other side, clients only need to authenticate the server cert, which was generated by the CA. So can I get away with only shipping the CA's ca.crt? That way the ICA can't give clients the ability to connect to servers other than mine... Or am I overthinking this again?

yes the clients only need the certificate that was used to sign the
server cert.

Post by Jason

Post by Jason
Last, any nuances to maintaining the CRLs wrt intermediate CA certs?

Looking at the code (easy-rsa/revoke-full) it seems written to handle ICA's. Does anyone have experience with this?

a revoked certificate ends up in a Certificate Revocation List (CRL);
CRLs are signed by the CA (or ICA) that issues them. The server would
need to get a "stacked" CRL file (i.e. the CRL files from all ICA
concatenated) in order for a revoked certificate to be picked up.
Alternatively you can work with the --capath parameter to supply a
directory of CA certs (ending in .0 ) and CRLs (ending in .r0)

HTH,

JJK