forum.lissyara.su

Код: Выделить всё

#pkg_info | grep openvpn
openvpn-2.1.1       Secure IP/Ethernet tunnel daemon

# uname -a
FreeBSD  6.1-RELEASE FreeBSD 6.1-RELEASE #0: Tue Aug 22 12:31:51 MSD 2006     root@:/usr/obj/usr/src/sys/WOLGATE  i386

Код: Выделить всё

doctormedia# sh
# ls
Makefile                build-key-pass          inherit-inter           revoke-full
README                  build-key-pkcs12        keys                    sign-req
build-ca                build-key-server        list-crl                vars
build-dh                build-req               openssl-0.9.6.cnf       whichopensslcnf
build-inter             build-req-pass          openssl.cnf
build-key               clean-all               pkitool
# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/share/doc/openvpn/easy-rsa/2.0/keys/server
# . ./clean-all
# . ./build-ca
Generating a 1024 bit RSA private key
..................................++++++
....................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:ru
State or Province Name (full name) [CA]:msk
Locality Name (eg, city) [SanFrancisco]:msk
Organization Name (eg, company) [Fort-Funston]:server
Organizational Unit Name (eg, section) []:server
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:server
Name []:server
Email Address [me@myhost.mydomain]:
# . ./build-key-server server
pkitool 2.0
Usage: pkitool [options...] [common-name]
Options:
  --batch    : batch mode (default)
  --keysize  : Set keysize
      size   : size (default=1024)
  --interact : interactive mode
  --server   : build server cert
  --initca   : build root CA
  --inter    : build intermediate CA
  --pass     : encrypt private key with password
  --csr      : only generate a CSR, do not sign
  --sign     : sign an existing CSR
  --pkcs12   : generate a combined PKCS#12 file
  --pkcs11   : generate certificate on PKCS#11 token
      lib    : PKCS#11 library
      slot   : PKCS#11 slot
      id     : PKCS#11 object id (hex string)
      label  : PKCS#11 object label
Standalone options:
  --pkcs11-slots   : list PKCS#11 slots
      lib    : PKCS#11 library
  --pkcs11-objects : list PKCS#11 token objects
      lib    : PKCS#11 library
      slot   : PKCS#11 slot
  --pkcs11-init    : initialize PKCS#11 token DANGEROUS!!!
      lib    : PKCS#11 library
      slot   : PKCS#11 slot
      label  : PKCS#11 token label
Notes:
  Please edit the vars script to reflect your configuration,
  then source it with "source ./vars".
  Next, to start with a fresh PKI configuration and to delete any
  previous certificates and keys, run "./clean-all".
  Finally, you can run this tool (pkitool) to build certificates/keys.
  In order to use PKCS#11 interface you must have opensc-0.10.0 or higher.
Generated files and corresponding OpenVPN directives:
(Files will be placed in the $KEY_DIR directory, defined in ./vars)
  ca.crt     -> root certificate (--ca)
  ca.key     -> root key, keep secure (not directly used by OpenVPN)
  .crt files -> client/server certificates (--cert)
  .key files -> private keys, keep secure (--key)
  .csr files -> certificate signing request (not directly used by OpenVPN)
  dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)
Examples:
  pkitool --initca          -> Build root certificate
  pkitool --initca --pass   -> Build root certificate with password-protected key
  pkitool --server server1  -> Build "server1" certificate/key
  pkitool client1           -> Build "client1" certificate/key
  pkitool --pass client2    -> Build password-protected "client2" certificate/key
  pkitool --pkcs12 client3  -> Build "client3" certificate/key in PKCS#12 format
  pkitool --csr client4     -> Build "client4" CSR to be signed by another CA
  pkitool --sign client4    -> Sign "client4" CSR
  pkitool --inter interca   -> Build an intermediate key-signing certificate/key
                               Also see ./inherit-inter script.
  pkitool --pkcs11 /usr/lib/pkcs11/lib1 0 010203 "client5 id" client5
                              -> Build "client5" certificate/key in PKCS#11 token
Typical usage for initial PKI setup.  Build myserver, client1, and client2 cert/keys.
Protect client2 key with a password.  Build DH parms.  Generated files in ./keys :
  [edit vars with your site-specific info]
  source ./vars
  ./clean-all
  ./build-dh     -> takes a long time, consider backgrounding
  ./pkitool --initca
  ./pkitool --server myserver
  ./pkitool client1
  ./pkitool --pass client2
Typical usage for adding client cert to existing PKI:
  source ./vars
  ./pkitool client-new
#

Код: Выделить всё

# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/share/doc/openvpn/easy-rsa/2.0/keys/server

Код: Выделить всё

# source ./vars
source: not found

Код: Выделить всё

. ./vars
sh ./build-key-server server1

Код: Выделить всё

chmod +x build-key-server

Код: Выделить всё

# sh ./build-key-server server
Generating a 1024 bit RSA private key
....++++++
..........................++++++
writing new private key to 'server.key'
-----