OpenVPN version 2.3.2: using new easyrsa mechanism for multiple users

1. Server setup
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa build-ca
2. User key and cert signing request on complete separate machine
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa gen-req myuser
3. Server signs user cert req
1. ./easyrsa import-req myuser.req myuser
2. ./easyrsa sign-req client myuser

Generate your server key and cert in a similar manner to a user.

Any client with a signed cert may connect to the server. There is no record of the client cert on the server itself; since the server signed the user cert, that is authority enough to validate the user cert.

Only if a user cert needs to be revoked, is a "revocation file" created on the server; this revocation file disallows that user from connecting. If no users need to be revoked, nothing needs to be done, nothing needs to exist about users on the server-side.

https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto

Openfire: use your 3rd-party, signed SSL cert

PLEASE LET ME KNOW IF YOU HAVE FIXES FOR THIS WITH LATEST VERSIONS

1. default keytool password is "changeit"
1. use it for all password prompts
2. works 99%
3. if it doesn't work, ask around, poke around
2. Get keytool command in your PATH
3. Use Openfire's web interface to "generate self-signed certificates"
1. NOTE: "import a signed certificate and its private key"
1. broken
1. says certs were loaded in green, but shows no result in "Server Certificates" list
2. whole reason for this post
4. find existing keystores on your chat server
1. nice updatedb
2. locate keystore
3. locate truststore
4. here, we'll assume /opt/openfire/resources/security
5. list the "domain" Openfire used for the "generate self-signed certificates" action above
1. keytool -list -v -keystore /opt/openfire/resources/security/keystore | grep rsa
1. e.g.: Alias name: my.domain.com_rsa
2. remember this for a later step
6. load your CAs root cert into the truststore
1. first, see if it is there
1. keytool -list -v -keystore /opt/openfire/resources/security/truststore | grep "Issuer:"
2. if not, download it from your CA, and
1. keytool -import -alias myCAsRootCertAlias -file myCAsRootCert.crt -keystore /opt/openfire/resources/security/truststore
2. verify
7. create a p12 with your key, cert and CA's cert
1. openssl pkcs12 -export -in myCert.crt -inkey myKey.key -out myP12.p12 -name my.domain.com_rsa -CAfile myCAsCert.crt -caname root
8. dump it to a new keystore
1. keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore mykeystore -srckeystore myP12.p12 -srcstoretype PKCS12 -srcstorepass changeit -alias my.domain.com_rsa
9. cp -v /opt/openfire/resources/security/keystore /opt/openfire/resources/security/keystore_2013xxyy
10. cp -v mykeystore /opt/openfire/resources/security/keystore
11. restart openfire

Generate IAM certs for users on AWS

1. openssl genrsa 1024 > username-env-pk.pem
1. pk stands for private key
2. openssl req -new -x509 -nodes -sha1 -days 365 -key username-env-pk.pem -outform PEM > username-env-cert.pem
1. lasts for 365
3. Paste username-env-cert.pem in to the AWS Signing Certificates area for that user
4. Give user both username-env-pk.pem and username-env-cert.pem, and wish them luck