一、证书制作

1、复制密钥生成文件EasyRSA-2.2.2到服务器目录

image.png

2、解压文件并给与777权限

  1. [root@localhost ~]# unzip EasyRSA-2.2.2.zip 
  2. [root@localhost ~]# chmod -R  777 EasyRSA-2.2.2

3、修改vars配置文件

  1. [root@localhost EasyRSA-2.2.2]# vim vars 
  2. [root@localhost EasyRSA-2.2.2]# grep -Ev '^#|^$' vars
  3. export EASY_RSA="`pwd`"
  4. export OPENSSL="openssl"
  5. export PKCS11TOOL="pkcs11-tool"
  6. export GREP="grep"
  7. export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
  8. export KEY_DIR="$EASY_RSA/keys"
  9. echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
  10. export PKCS11_MODULE_PATH="dummy"
  11. export PKCS11_PIN="dummy"
  12. export KEY_SIZE=2048
  13. export CA_EXPIRE=3650
  14. export KEY_EXPIRE=3650
  15. export KEY_COUNTRY="cn"        #国家
  16. export KEY_PROVINCE="henan"        #省
  17. export KEY_CITY="zhengzhou"        #城市
  18. export KEY_ORG="xinan"        #组织
  19. export KEY_EMAIL="3037800336@qq.com"        #邮箱
  20. export KEY_OU="xinan"        #公司、组织
  21. export KEY_NAME="EasyRSA"        
  22. [root@localhost EasyRSA-2.2.2]# source vars
  23. NOTE: If you run ./clean-all, I will be doing a rm -rf on /root/EasyRSA-2.2.2/keys
  24. #刷新环境并更新配置，以后的密钥文件都放在keys目录下
  25. [root@localhost EasyRSA-2.2.2]# ./clean-all
  26. [root@localhost EasyRSA-2.2.2]# ls
  27. build-ca     build-key-pass    build-req       keys               openssl-1.0.0.cnf  vars
  28. build-dh     build-key-pkcs12  build-req-pass  list-crl           pkitool            whichopensslcnf
  29. build-inter  build-key-server  clean-all       openssl-0.9.6.cnf  revoke-full
  30. build-key    build-ner         inherit-inter   openssl-0.9.8.cnf  sign-req

4、生成根证书和密钥

ca.crt ca.key

  1. [root@localhost EasyRSA-2.2.2]# ./build-ca
  2. Generating a 2048 bit RSA private key
  3. ..+++
  4. ......+++
  5. writing new private key to 'ca.key'
  6. -----
  7. You are about to be asked to enter information that will be incorporated
  8. into your certificate request.
  9. What you are about to enter is what is called a Distinguished Name or a DN.
  10. There are quite a few fields but you can leave some blank
  11. For some fields there will be a default value,
  12. If you enter '.', the field will be left blank.
  13. -----
  14. Country Name (2 letter code) [cn]:
  15. State or Province Name (full name) [henan]:
  16. Locality Name (eg, city) [zhengzhou]:
  17. Organization Name (eg, company) [xinan]:
  18. Organizational Unit Name (eg, section) [xinan]:
  19. Common Name (eg, your name or your server's hostname) [xinan CA]:
  20. Name [EasyRSA]:
  21. Email Address [3037800336@qq.com]:
  22. [root@localhost EasyRSA-2.2.2]# ls keys
  23. ca.crt  ca.key  index.txt  serial

5、生成服务端证书和密钥

server.crt server.key

  1. [root@localhost EasyRSA-2.2.2]# ./build-key-server server
  2. Generating a 2048 bit RSA private key
  3. ........................................................+++
  4. ...............................................+++
  5. writing new private key to 'server.key'
  6. -----
  7. You are about to be asked to enter information that will be incorporated
  8. into your certificate request.
  9. What you are about to enter is what is called a Distinguished Name or a DN.
  10. There are quite a few fields but you can leave some blank
  11. For some fields there will be a default value,
  12. If you enter '.', the field will be left blank.
  13. -----
  14. Country Name (2 letter code) [cn]:
  15. State or Province Name (full name) [henan]:
  16. Locality Name (eg, city) [zhengzhou]:
  17. Organization Name (eg, company) [xinan]:
  18. Organizational Unit Name (eg, section) [xinan]:
  19. Common Name (eg, your name or your server's hostname) [server]:
  20. Name [EasyRSA]:
  21. Email Address [3037800336@qq.com]:
  23. Please enter the following 'extra' attributes
  24. to be sent with your certificate request
  25. A challenge password []:
  26. An optional company name []:
  27. Using configuration from /root/EasyRSA-2.2.2/openssl-1.0.0.cnf
  28. Check that the request matches the signature
  29. Signature ok
  30. The Subject's Distinguished Name is as follows
  31. countryName           :PRINTABLE:'cn'
  32. stateOrProvinceName   :PRINTABLE:'henan'
  33. localityName          :PRINTABLE:'zhengzhou'
  34. organizationName      :PRINTABLE:'xinan'
  35. organizationalUnitName:PRINTABLE:'xinan'
  36. commonName            :PRINTABLE:'server'
  37. name                  :PRINTABLE:'EasyRSA'
  38. emailAddress          :IA5STRING:'3037800336@qq.com'
  39. Certificate is to be certified until Jul  5 00:52:45 2031 GMT (3650 days)
  40. Sign the certificate? [y/n]:y
  43. 1 out of 1 certificate requests certified, commit? [y/n]y
  44. Write out database with 1 new entries
  45. Data Base Updated
  46. [root@localhost EasyRSA-2.2.2]# ls keys
  47. 01.pem  ca.crt  ca.key  index.txt  index.txt.attr  index.txt.old  serial  serial.old  server.crt  server.csr  server.key

6、生成客户端证书和密钥

client.key client.crt

  1. [root@localhost EasyRSA-2.2.2]# ./build-key client
  2. Generating a 2048 bit RSA private key
  3. ..........................+++
  4. ...................................+++
  5. writing new private key to 'client.key'
  6. -----
  7. You are about to be asked to enter information that will be incorporated
  8. into your certificate request.
  9. What you are about to enter is what is called a Distinguished Name or a DN.
  10. There are quite a few fields but you can leave some blank
  11. For some fields there will be a default value,
  12. If you enter '.', the field will be left blank.
  13. -----
  14. Country Name (2 letter code) [cn]:
  15. State or Province Name (full name) [henan]:
  16. Locality Name (eg, city) [zhengzhou]:
  17. Organization Name (eg, company) [xinan]:
  18. Organizational Unit Name (eg, section) [xinan]:
  19. Common Name (eg, your name or your server's hostname) [client]:
  20. Name [EasyRSA]:
  21. Email Address [3037800336@qq.com]:
  23. Please enter the following 'extra' attributes
  24. to be sent with your certificate request
  25. A challenge password []:
  26. An optional company name []:
  27. Using configuration from /root/EasyRSA-2.2.2/openssl-1.0.0.cnf
  28. Check that the request matches the signature
  29. Signature ok
  30. The Subject's Distinguished Name is as follows
  31. countryName           :PRINTABLE:'cn'
  32. stateOrProvinceName   :PRINTABLE:'henan'
  33. localityName          :PRINTABLE:'zhengzhou'
  34. organizationName      :PRINTABLE:'xinan'
  35. organizationalUnitName:PRINTABLE:'xinan'
  36. commonName            :PRINTABLE:'client'
  37. name                  :PRINTABLE:'EasyRSA'
  38. emailAddress          :IA5STRING:'3037800336@qq.com'
  39. Certificate is to be certified until Jul  5 00:55:35 2031 GMT (3650 days)
  40. Sign the certificate? [y/n]:y
  43. 1 out of 1 certificate requests certified, commit? [y/n]y
  44. Write out database with 1 new entries
  45. Data Base Updated
  46. [root@localhost EasyRSA-2.2.2]# ls keys/
  47. 01.pem  ca.crt  client.crt  client.key  index.txt.attr      index.txt.old  serial.old  server.csr
  48. 02.pem  ca.key  client.csr  index.txt   index.txt.attr.old  serial         server.crt  server.key

7、生成密钥交换文件

dh2048.pem

  1. [root@localhost EasyRSA-2.2.2]# ./build-dh 
  2. Generating DH parameters, 2048 bit long safe prime, generator 2
  3. This is going to take a long time
  4. ............................................................+.............................................+................................+...................................................................+..........................+..................................................................................................+..................................................................................................................+.....+..+........+.+.......
  5. [root@localhost EasyRSA-2.2.2]# ls keys
  6. 01.pem  ca.crt  client.crt  client.key  index.txt       index.txt.attr.old  serial      server.crt  server.key
  7. 02.pem  ca.key  client.csr  dh2048.pem  index.txt.attr  index.txt.old       serial.old  server.csr

二、配置OpenVPN服务端

1、安装OpenVPN并修改配置文件

  1. [root@localhost EasyRSA-2.2.2]# cd /etc/yum.repos.d/
  2. [root@localhost yum.repos.d]# curl -o epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
  3.   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
  4.                                  Dload  Upload   Total   Spent    Left  Speed
  5. 100   664  100   664    0     0  10639      0 --:--:-- --:--:-- --:--:-- 10709
  6. [root@localhost yum.repos.d]# ls
  7. CentOS-Base.repo       CentOS-fasttrack.repo  CentOS-Vault.repo          epel.repo
  8. CentOS-CR.repo         CentOS-Media.repo      CentOS-x86_64-kernel.repo
  9. CentOS-Debuginfo.repo  CentOS-Sources.repo    docker-ce.repo
  10. [root@localhost yum.repos.d]# yum clean all && yum makecache
  11. [root@localhost yum.repos.d]# yum -y install openvpn
  13. #配置openvpn    配置文件在/etc/openvpn
  14. [root@localhost yum.repos.d]# cd /etc/openvpn/
  15. [root@localhost openvpn]# mkdir keys
  16. [root@localhost keys]# cd /root/EasyRSA-2.2.2/keys
  17. #复制证书文件
  18. [root@localhost keys]# cp {server.crt,server.key,ca.crt,dh2048.pem} /etc/openvpn/keys
  19. [root@localhost keys]# cd /etc/openvpn/keys
  20. [root@localhost keys]# ls
  21. ca.crt  dh2048.pem  server.crt  server.key
  22. #复制配置文件
  23. [root@localhost keys]# cp /usr/share/doc/openvpn-2.4.11/sample/sample-config-files/server.conf ../
  24. [root@localhost keys]# vim ../server.conf 
  25. [root@localhost keys]# grep -Ev '^#|^$' ../server.conf 
  26. ;local a.b.c.d
  27. port 1194
  28. ;proto tcp
  29. proto udp
  30. ;dev tap
  31. dev tun
  32. ;dev-node MyTap
  33. ca keys/ca.crt
  34. cert keys/server.crt
  35. key keys/server.key  # This file should be kept secret
  36. dh keys/dh2048.pem
  37. ;topology subnet
  38. server 10.0.1.0 255.255.255.0    #客户端进来以后分配的地址网段
  39. ifconfig-pool-persist ipp.txt
  40. ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
  41. ;server-bridge
  42. ;push "route 192.168.10.0 255.255.255.0"
  43. ;push "route 192.168.20.0 255.255.255.0"
  44. push "route 10.0.1.0 255.255.255.0"    #添加路由规则要跟上面的分配网段一致
  45. push "route 192.168.0.0 255.255.255.0"    #添加内网路由规则
  46. ;client-config-dir ccd
  47. ;route 192.168.40.128 255.255.255.248
  48. ;client-config-dir ccd
  49. ;route 10.9.0.0 255.255.255.252
  50. ;learn-address ./script
  51. ;push "redirect-gateway def1 bypass-dhcp"
  52. ;push "dhcp-option DNS 208.67.222.222"
  53. ;push "dhcp-option DNS 208.67.220.220"
  54. ;client-to-client
  55. ;duplicate-cn
  56. keepalive 10 120
  57. tls-auth keys/ta.key 0    #拒绝服务攻击文件
  58. cipher AES-256-GCM    #加密模式
  59. ;compress lz4-v2
  60. ;push "compress lz4-v2"
  61. ;comp-lzo
  62. ;max-clients 100
  63. ;user nobody
  64. ;group nobody
  65. persist-key
  66. persist-tun
  67. status openvpn-status.log
  68. ;log         openvpn.log
  69. ;log-append  openvpn.log
  70. verb 3
  71. ;mute 20
  72. explicit-exit-notify 1
  74. #启用路由转发
  75. [root@localhost keys]# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf 
  76. [root@localhost keys]# sysctl -p
  77. net.ipv4.ip_forward = 1

2、建立ta.key文件（拒绝服务攻击证书文件）

  1. [root@localhost keys]# openvpn --genkey --secret ta.key
  2. [root@localhost keys]# ls
  3. ca.crt  dh2048.pem  server.crt  server.key  ta.key

3、启动openvpn服务

  1. [root@localhost openvpn]# cd /etc/openvpn/
  2. [root@localhost openvpn]# openvpn --daemon --config server.conf 
  3. [root@localhost openvpn]# netstat -tlnup | grep 1194
  4. udp        0      0 0.0.0.0:1194            0.0.0.0:*                           20157/openvpn