{"id":226,"date":"2020-08-18T19:47:57","date_gmt":"2020-08-19T01:47:57","guid":{"rendered":"https:\/\/ha.lc\/?p=226"},"modified":"2020-08-18T19:47:57","modified_gmt":"2020-08-19T01:47:57","slug":"openvpn-expired-certificates","status":"publish","type":"post","link":"https:\/\/ha.lc\/?p=226","title":{"rendered":"Openvpn expired certificates"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>Taken from here:<\/p>\n\n\n\n<p><a href=\"https:\/\/buger.dread.cz\/openvpn-expired-certificates.html\">https:\/\/buger.dread.cz\/openvpn-expired-certificates.html<\/a><\/p>\n\n\n\n<p>On 18.08.2020<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Thank you man, very useful.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><a href=\"https:\/\/buger.dread.cz\/openvpn-expired-certificates.html\">OpenVPN &#8211; expired certificates<\/a><\/h1>\n\n\n\n<p>2018-11-13 00:00 | tags: <a href=\"https:\/\/buger.dread.cz\/tag\/linux.html\">linux<\/a><a href=\"https:\/\/buger.dread.cz\/tag\/vpn.html\">vpn<\/a><a href=\"https:\/\/buger.dread.cz\/tag\/openvpn.html\">openvpn<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Server certificates<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">CA certificate<\/h2>\n\n\n\n<p>In case that CA certificate (lets name it ca.crt) gets expired, clients can&#8217;t connect to the OpenVPN server anymore. You need to generate new CA certificate signed with the same key (usually named ca.key) as the old one to avoid the need to regenerate all client certificates also.<\/p>\n\n\n\n<p>Use following command to do so:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">openssl x509 -in ca.crt -days 36500 -out ca.crt.new -signkey ca.key\n<\/pre>\n\n\n\n<ul><li>36500days = 100years = validity of the new ca.crt<\/li><li>rename ca.crt to ca.crt.old<\/li><li>rename ca.crt.new to ca.crt<\/li><li>restart \/ reload OpenVPN<\/li><li>distribute new ca.crt to all clients<\/li><li>check server certificate &#8211; it usually expires also, because both are generated during OpenVPN installation and usually have the same validity<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Server certificate<\/h2>\n\n\n\n<p>In case that server certificate gets expired, simply generate new one using easy-rsa scripts:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">. vars\n.\/buid-key-server server\n<\/pre>\n\n\n\n<ul><li>reload \/ restart OpenVPN after that<\/li><\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">Client certificate(s)<\/h1>\n\n\n\n<p>When client certificate gets expired, you can generate new one using previous .csr file this way:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">. vars\n.\/sign-req &lt;certificate-name&gt;\n<\/pre>\n\n\n\n<ul><li>send the new .crt file to the client<\/li><li>client&#8217;s .key file is not changed =&gt; same password, we don&#8217;t need to know it to generate new .crt<\/li><\/ul>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>https:\/\/buger.dread.cz\/openvpn-expired-certificates.html<\/p><\/blockquote>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Taken from here: https:\/\/buger.dread.cz\/openvpn-expired-certificates.html On 18.08.2020 Thank you man, very useful. OpenVPN &#8211; expired certificates 2018-11-13 00:00 | tags: linuxvpnopenvpn Server certificates CA certificate In case that CA certificate (lets name it ca.crt) gets expired, clients can&#8217;t connect to the OpenVPN server anymore. You need to generate new CA certificate signed with the same key &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/ha.lc\/?p=226\" class=\"more-link\">Continuar leyendo<span class=\"screen-reader-text\"> &#8220;Openvpn expired certificates&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/posts\/226"}],"collection":[{"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ha.lc\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=226"}],"version-history":[{"count":1,"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/posts\/226\/revisions"}],"predecessor-version":[{"id":227,"href":"https:\/\/ha.lc\/index.php?rest_route=\/wp\/v2\/posts\/226\/revisions\/227"}],"wp:attachment":[{"href":"https:\/\/ha.lc\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ha.lc\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ha.lc\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}