[Openvpn-users] Transfer Easy-RSA PKI to OpenVPN Access Server.

[Sean Byrne]

Is it possible to migrate from the open source version of OpenVPN to
another instance running OpenVPN Access Server? I used Easy-RSA to set up
my PIK.

And if it's not possible to transfer, is it possible to set up a PKI with
OpenVPN Access Server.

Thanks,
Sean

[/dev/rob0]

Post by Sean Byrne
Is it possible to migrate from the open source version of OpenVPN
to another instance running OpenVPN Access Server? I used Easy-RSA
to set up my PIK.

Of course. You simply copy the server key and certificate, with the
CA certificate, to the Access Server. Where to place those files
would be a matter for OpenVPN-AS support to answer.

Alternatively you might choose to generate a new server key and
certificate in place of the old one.

You should *NOT*, however, do what your subject line implies, and
copy the Easy-RSA PKI to the new server. The PKI should be
maintained on a separate physical machine, preferably one not
participating in the VPN in any manner.

(Also resist the urge to use a virtual machine for a PKI, because
they lack entropy needed for random number generation.)

Post by Sean Byrne
And if it's not possible to transfer, is it possible to set up
a PKI with OpenVPN Access Server.

Easy-rsa is simply a frontend for OpenSSL's ca(1) utility, but again,
specific questions regarding OpenVPN-AS don't belong here.