Trying to generate OpenVPN crypto keys, certs, etc. - Page 1
Forum section: electronics / general

author: soldar
author_rank: Super Contributor
timestamp: January 28, 2025, 01:12:03 pm
content: I am very frustrated with this issue and I am beginning to understand the general perception of Linux and the command line as something from the Devil.I have a TP-Link Archer C7 router which has OpenVPN installed. With three clicks it is up and running and generates a configuration file for the client. Could not be easier.1- Turn OpenVPN ON2- Generate encryption keys3- Generate configuration file for the clientThree clicks.I bought another TP-Link Archer C7 router on eBay but it is an earlier version which does not have OpenVPN. No matter I thought to myself, I will install OpenWRT, which I have already done other times, and then I will install OpenVPN. So I did, and so far so good.But then I have to generate the encryption certificates, for the server and for the clients, and it has turned into a nightmare. OpenVPN does not include any tools for generating the keys/certificates and it has to be done from the command line. This is where the nightmare begins. I download the programs, I look for tutorials, but nothing works, I am going around in circles like crazy, not understanding anything I am doing. This is something which should be able to be done with a single click but all I see is tutorials which are way too long and which each has a point where I get stuck and get an error. A thousand different versions of Linux, of crypto tools, of bugs. And I have no idea of what I am trying to do. Those tutorials are written for people who "speak Linux" and I don't.I believe I can generate the keys in any Linux machine and then transfer the files to the server and the clients.As far as I understand it I am only trying to create four or maybe six files.The Linux Mint client asks, clearly, for three TLS certificates1- CA certificate, ca.pem2- User certificate, cert.pem3- User private key, key.pemI might assume the server needs another three, similar, symmetrical files.I am not afraid of the command line but I do not understand why something apparently so simple requires lines and more lines and yet more lines of commands. I just do not understand why there isn't a simple GUI or script that will do this in one go. The TP-Link router has it and does it. OpenVPN should include a tool to do this.So, can anyone help me with this?

author: voltsandjolts
author_rank: Unknown
timestamp: January 28, 2025, 01:28:24 pm
content: Forget OpenVPN, the new standard is WireGuard and it's easier to setup...https://openwrt.org/docs/guide-user/services/vpn/wireguard/server

author: bingo600
author_rank: Super Contributor
timestamp: February 06, 2025, 06:08:29 pm
content: Try easy-rsa 2https://github.com/OpenVPN/easy-rsa-oldor easy-rsa3https://github.com/OpenVPN/easy-rsaRef:https://openvpn.net/community-resources/setting-up-your-own-certificate-authority-ca/

author: Hogwild
author_rank: Regular Contributor
timestamp: April 14, 2025, 10:16:10 pm
content: Have you checked to see if perhaps there's a firmware update for the second router that includes OpenVPN?Maybe the Algo open source VPN configurator tool might work for you:https://github.com/trailofbits/algo