eBlocker Mobile CA

Client and server certificates for the eBlocker Mobile feature are issued by the class OpenVpnCa in version 2.5.1 or later. Previously, the package easy-rsa was used. The post-install script of the package eblocker-icapserver imports an existing CA created by easy-rsa.

Files

Which files does the eBlocker Mobile CA need?

• ca.crt: CA certificate
• ca.key: CA private key
• crl.pem: revocation list of device certificates
• All client certificates (for revocation)

The CA generates these private keys and certificates:

• its own (during initialization)
• the OpenVPN server's (during initialization)
• each client's

Which files does the OpenVPN server need?

• ca.crt: see above
• crl.pem: see above
• eblocker.crt: server certificate
• eblocker.key: server private key
• dh2048.pem: Diffie-Hellman parameters, generated by OpenSSL
• ta.key: static key for additional protection against DoS attacks (see option tls-auth). The key is generated by openvpn.

Which files do the clients need (in their configuration)?

• ca.crt: see above
• ta.key: see above
• device:MAC.crt: client certificate
• device:MAC.key: client private key

All these files must be imported from easy-rsa:

• ca.crt
• ca.key
• crl.pem
• eblocker.crt
• eblocker.key
• dh2048.pem
• ta.key
• device:*.crt
• device:*.key

Directories

• /opt/eblocker-icap/keys/mobile: CA writes its keys, certificates and CRLs here.
• /opt/eblocker-icap/keys/mobile/clients: CA writes client keys and certificates here. Revoked keys and certificates are deleted.
• /etc/openvpn: All files that the OpenVPN server accesses directly are copied/generated here.

Import from easy-rsa

• Copy CA files (including CRL) from /etc/openvpn/easy-rsa to /opt/eblocker-icap/keys/mobile. Change owner of files to icapd.
• Copy client keys and certificates from /etc/openvpn/easy-rsa to /opt/eblocker-icap/keys/mobile/clients. Change owner of files to icapd.
• Remove /etc/openvpn/easy-rsa directory recursively.

Server control script

The server control script openvpn-server-control has the following modes:

init

• Create Diffie-Hellman parameters
• Create shared secret ta.key
• Make CA certificate, CRL and server key and certificate available to OpenVPN.

start

• Start OpenVPN server

stop

• Stop OpenVPN server

status

• Get status of OpenVPN server

purge

• Remove all keys, certificates, CRLs, Diffie-Hellman parameters and shared secrets.

update-crl

• Copy the CRL generated by OpenVpnCa to the OpenVPN configuration directory.