- •Credits
- •About the Author
- •About the Reviewers
- •www.PacktPub.com
- •Table of Contents
- •Preface
- •Introduction
- •Shortest setup possible
- •OpenVPN secret keys
- •Multiple secret keys
- •Plaintext tunnel
- •Routing
- •Configuration files versus the command-line
- •Complete site-to-site setup
- •3-way routing
- •Introduction
- •Setting up the public and private keys
- •Simple configuration
- •Server-side routing
- •Routing: subnets on both sides
- •Redirecting the default gateway
- •Using an 'ifconfig-pool' block
- •Using the status file
- •Management interface
- •Proxy-arp
- •Introduction
- •Simple configuration—non-bridged
- •Enabling client-to-client traffic
- •Bridging—Linux
- •Bridging—Windows
- •Checking broadcast and non-IP traffic
- •External DHCP server
- •Using the status file
- •Management interface
- •Introduction
- •Certificate generation
- •xCA: a GUI for managing a PKI (Part 1)
- •xCA: a GUI for managing a PKI (Part 2)
- •OpenSSL tricks: x509, pkcs12, verify output
- •Revoking certificates
- •The use of CRLs
- •Checking expired/revoked certificates
- •Intermediary CAs
- •Multiple CAs: stacking, using --capath
- •Introduction
- •Initializing a hardware token
- •Getting a hardware token ID
- •Using a hardware token
- •Selecting a PKCS#11 certificate using the management interface
- •Generating a key on the hardware token
- •Private method for getting a PKCS#11 certificate
- •Pin caching example
- •Introduction
- •Using a client-side up/down script
- •Windows login greeter
- •Using client-connect/client-disconnect scripts
- •Using a 'learn-address' script
- •Using a 'tls-verify' script
- •Using an 'auth-user-pass-verify' script
- •Script order
- •Script security and logging
- •Using the 'down-root' plugin
- •Using the PAM authentication plugin
- •Introduction
- •Cipher mismatches
- •TUN versus TAP mismatches
- •Compression mismatches
- •Key mismatches
- •Troubleshooting MTU and tun-mtu issues
- •Troubleshooting network connectivity
- •How to read the OpenVPN log files
- •Introduction
- •The missing return route
- •Missing return routes when 'iroute' is used
- •Source routing
- •Routing and permissions on Windows
- •Troubleshooting client-to-client traffic routing
- •Understanding the 'MULTI: bad source' warnings
- •Failure when redirecting the default gateway
- •Introduction
- •Optimizing performance using 'ping'
- •OpenSSL cipher speed
- •Compression tests
- •Traffic shaping
- •Tuning UDP-based connections
- •Tuning TCP-based connections
- •Analyzing performance using tcpdump
- •Introduction
- •Linux: using NetworkManager
- •MacOS: using Tunnelblick
- •Windows Vista/7: elevated privileges
- •Windows: using the CryptoAPI store
- •Windows: updating the DNS cache
- •Windows: running OpenVPN as a service
- •Windows: public versus private network adapters
- •Windows: routing methods
- •Introduction
- •Including configuration files in config files
- •Details of ifconfig-pool-persist
- •Connecting using a SOCKS proxy
- •Connecting via an HTTP proxy
- •Connecting via an HTTP proxy with authentication
- •Using dyndns
- •IP-less setups (ifconfig-noexec)
- •Introduction
- •Inline certificates
- •Connection blocks
- •Port sharing with an HTTPS server
- •Routing features: redirect-private, allow-pull-fqdn
- •OCSP support
- •New for 2.2: the 'x509_user_name' parameter
- •Index
PKI, Certificates, and OpenSSL
5. In the next dialog, click on Always trust this certificate and then on OK:
By trusting the CA certificate, it will allow us to generate and sign new certificates.
How it works...
xCA stores all the public and private keys in a database. This database must be protected using a strong password, as it can be used to sign and revoke all the certificates that we want to use in our OpenVPN setups.
There's more...
For this recipe, we choose xCA as the PKI solution. There are many PKI solutions available, both open source and commercial. For example:
tinyCA: http://tinyca.sm-zone.net/
OpenCA: http://www.openca.org
xCA: a GUI for managing a PKI (Part 2)
This recipe is the second part explaining how to use xCA, a graphical tool for managing a public key infrastructure (PKI). In this recipe, we create a new certificate using the xCA GUI.
108
Chapter 4
Getting ready
First, read the previous recipe and follow the instructions.
How to do it...
1.Start xCA and open our database using File | Open Database. Click on the tab
Certificates and then right-click on our CA certificate. Choose the option New certificate. A dialog box will appear. Click on the tab Source and fill in the details
Internal name, Country Code, Organisation, Common name, and Email Address:
109
PKI, Certificates, and OpenSSL
2. Do not press OK; press Generate a new key first:
Select the Keysize as 1024 bit (or higher, if desired) and click on the Create button.
3. Next, fill in the tab Extensions as follows:
110
Chapter 4
Select for Type, End Entity.
Mark the checkbox Subject Key Identifer as enabled.
Mark the checkbox Authority Key Identifer as enabled.
4.Finally, go to the tab Key Usage and do as follows:
In the column Key Usage, select Digital Signature.
In the column Extended Key Usage, select TLS Web Client Authentication for an OpenVPN client certificate. For an OpenVPN server certificate, choose TLS Web Server Authentication. Never choose both for the same certificate! Press OK to generate the certificate.
111