OpenVPN version 2.3.2: using new easyrsa mechanism for multiple users

1. Server setup
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa build-ca
2. User key and cert signing request on complete separate machine
1. ./easyrsa init-pki
1. don't do this twice!
2. ./easyrsa gen-req myuser
3. Server signs user cert req
1. ./easyrsa import-req myuser.req myuser
2. ./easyrsa sign-req client myuser

Generate your server key and cert in a similar manner to a user.

Any client with a signed cert may connect to the server. There is no record of the client cert on the server itself; since the server signed the user cert, that is authority enough to validate the user cert.

Only if a user cert needs to be revoked, is a "revocation file" created on the server; this revocation file disallows that user from connecting. If no users need to be revoked, nothing needs to be done, nothing needs to exist about users on the server-side.

https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto

Generate gpg keys, upload to server, pull from server, from CLI

1. gpg --gen-key
2. gpg --list-keys
3. gpg --keyserver pgp.mit.edu --send-keys '62E49F5A'
1. that funky number is listed in the output of "list-keys", just look carefully
1. your funky number will be unique
2. should be 8 digits long and hex
4. gpg --keyserver pgp.mit.edu --search-keys 'youremail@yahoo.com'
5. gpg --keyserver pgp.mit.edu --search-keys 'yourgirl@yahoo.com'
6. gpg --keyserver pgp.mit.edu --recv-keys 1F3B6ACA
1. Get her key with the ID you saw in previous step
7. Use keys to encrypt content
1. Can be encrypted for multiple people in one go, and only those listed can open the result