OpenVPN server with client certificate and password authentication.

sudo -s
cd /root
apt update
apt upgrade
apt install openvpn easy-rsa
rehash
/etc/init.d/openvpn stop
update-rc.d openvpn disable

Create the certificate storage directory and intialise it.

make-cadir easy-rsa
cd easy-rsa
./easyrsa init-pki hard-reset

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /root/ovpn/pki

Edit the `vars' file changing organisational data.

Eg.

set_var EASYRSA_REQ_COUNTRY     "GB"
set_var EASYRSA_REQ_PROVINCE    "England"
set_var EASYRSA_REQ_CITY        "London"
set_var EASYRSA_REQ_ORG         "OVPN"
set_var EASYRSA_REQ_EMAIL       "root@example.com"
set_var EASYRSA_REQ_OU          "CA"

The CA expiry date defaults to 10 years (3650 days) and certificates to 825 days. Change this to your preferred timespan.

set_var EASYRSA_CA_EXPIRE   3650
set_var EASYRSA_CERT_EXPIRE 3650

Create a CA for managing certificates. Choose a secret passphrase.

./easyrsa --vars=./vars build-ca
Enter New CA Key Passphrase:
...
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/ovpn/pki/ca.crt

The server certificate will be utilised by the OpenVPN daemon, sign it with the CA passphrase.

./easyrsa --vars=./vars build-server-full server nopass
Enter pass phrase for /root/ovpn/pki/private/ca.key:
...

./easyrsa --vars=./vars gen-dh

TODO determine if not superceded.

openvpn --genkey secret pki/ta.key

./easyrsa --vars=./vars build-client-full vpn1 nopass