Nyr
commented
9 years ago I can't reproduce it:
root@ovpn-test:~# wget git.io/vpn --no-check-certificate -O openvpn-install.sh; bash openvpn-install.sh
--2015-06-29 03:11:14-- http://git.io/vpn
Resolving git.io (git.io)... 23.21.43.130, 54.197.244.180, 54.235.132.156
Connecting to git.io (git.io)|23.21.43.130|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh [following]
--2015-06-29 03:11:14-- https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh
Resolving raw.github.com (raw.github.com)... 185.31.19.133
Connecting to raw.github.com (raw.github.com)|185.31.19.133|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh [following]
--2015-06-29 03:11:15-- https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.31.17.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.31.17.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11744 (11K) [text/plain]
Saving to: ‘openvpn-install.sh’
100%[=========================================================================================================================================>] 11,744 --.-K/s in 0s
2015-06-29 03:11:15 (140 MB/s) - ‘openvpn-install.sh’ saved [11744/11744]
grep: /etc/redhat-release: No such file or directory
Welcome to this quick OpenVPN "road warrior" installer
I need to ask you a few questions before starting the setup
You can leave the default options and just press enter if you are ok with them
First I need to know the IPv4 address of the network interface you want OpenVPN
listening to.
IP address: 188.166.77.10
What port do you want for OpenVPN?
Port: 1194
Do you want OpenVPN to be available at port 53 too?
This can be useful to connect under restrictive networks
Listen at port 53 [y/n]: n
Do you want to enable internal networking for the VPN?
This can allow VPN clients to communicate between them
Allow internal networking [y/n]: n
What DNS do you want to use with the VPN?
1) Current system resolvers
2) OpenDNS
3) Level 3
4) NTT
5) Hurricane Electric
6) Yandex
DNS [1-6]: 1
Finally, tell me your name for the client cert
Please, use one word only, no special characters
Client name: client
Okay, that was all I needed. We are ready to setup your OpenVPN server now
Press any key to continue...
Ign http://security.ubuntu.com trusty-security InRelease
Get:1 http://security.ubuntu.com trusty-security Release.gpg [933 B]
Get:2 http://security.ubuntu.com trusty-security Release [63.5 kB]
Ign http://mirrors.digitalocean.com trusty InRelease
Ign http://mirrors.digitalocean.com trusty-updates InRelease
Get:3 http://security.ubuntu.com trusty-security/main Sources [87.2 kB]
Get:4 http://security.ubuntu.com trusty-security/universe Sources [26.5 kB]
Hit http://mirrors.digitalocean.com trusty Release.gpg
Get:5 http://security.ubuntu.com trusty-security/main amd64 Packages [304 kB]
Get:6 http://mirrors.digitalocean.com trusty-updates Release.gpg [933 B]
Get:7 http://security.ubuntu.com trusty-security/universe amd64 Packages [109 kB]
Get:8 http://security.ubuntu.com trusty-security/main i386 Packages [289 kB]
Hit http://mirrors.digitalocean.com trusty Release
Get:9 http://security.ubuntu.com trusty-security/universe i386 Packages [109 kB]
Get:10 http://security.ubuntu.com trusty-security/main Translation-en [159 kB]
Get:11 http://mirrors.digitalocean.com trusty-updates Release [63.5 kB]
Get:12 http://security.ubuntu.com trusty-security/universe Translation-en [62.1 kB]
Hit http://mirrors.digitalocean.com trusty/main Sources
Hit http://mirrors.digitalocean.com trusty/universe Sources
Hit http://mirrors.digitalocean.com trusty/main amd64 Packages
Hit http://mirrors.digitalocean.com trusty/universe amd64 Packages
Hit http://mirrors.digitalocean.com trusty/main i386 Packages
Hit http://mirrors.digitalocean.com trusty/universe i386 Packages
Hit http://mirrors.digitalocean.com trusty/main Translation-en
Hit http://mirrors.digitalocean.com trusty/universe Translation-en
Get:13 http://mirrors.digitalocean.com trusty-updates/main Sources [212 kB]
Get:14 http://mirrors.digitalocean.com trusty-updates/universe Sources [122 kB]
Get:15 http://mirrors.digitalocean.com trusty-updates/main amd64 Packages [562 kB]
Get:16 http://mirrors.digitalocean.com trusty-updates/universe amd64 Packages [290 kB]
Get:17 http://mirrors.digitalocean.com trusty-updates/main i386 Packages [548 kB]
Get:18 http://mirrors.digitalocean.com trusty-updates/universe i386 Packages [291 kB]
Get:19 http://mirrors.digitalocean.com trusty-updates/main Translation-en [271 kB]
Get:20 http://mirrors.digitalocean.com trusty-updates/universe Translation-en [152 kB]
Ign http://mirrors.digitalocean.com trusty/main Translation-en_US
Ign http://mirrors.digitalocean.com trusty/universe Translation-en_US
Fetched 3,724 kB in 6s (575 kB/s)
Reading package lists... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
iptables is already the newest version.
The following extra packages will be installed:
liblzo2-2 libpkcs11-helper1
Suggested packages:
easy-rsa
The following NEW packages will be installed:
liblzo2-2 libpkcs11-helper1 openvpn
The following packages will be upgraded:
openssl
1 upgraded, 3 newly installed, 0 to remove and 57 not upgraded.
Need to get 967 kB of archives.
After this operation, 1,347 kB of additional disk space will be used.
Get:1 http://mirrors.digitalocean.com/ubuntu/ trusty-updates/main liblzo2-2 amd64 2.06-1.2ubuntu1.1 [46.1 kB]
Get:2 http://mirrors.digitalocean.com/ubuntu/ trusty/main libpkcs11-helper1 amd64 1.11-1 [42.2 kB]
Get:3 http://mirrors.digitalocean.com/ubuntu/ trusty-updates/main openssl amd64 1.0.1f-1ubuntu2.15 [489 kB]
Get:4 http://mirrors.digitalocean.com/ubuntu/ trusty-updates/main openvpn amd64 2.3.2-7ubuntu3.1 [390 kB]
Fetched 967 kB in 0s (1,975 kB/s)
Preconfiguring packages ...
Selecting previously unselected package liblzo2-2:amd64.
(Reading database ... 86964 files and directories currently installed.)
Preparing to unpack .../liblzo2-2_2.06-1.2ubuntu1.1_amd64.deb ...
Unpacking liblzo2-2:amd64 (2.06-1.2ubuntu1.1) ...
Selecting previously unselected package libpkcs11-helper1:amd64.
Preparing to unpack .../libpkcs11-helper1_1.11-1_amd64.deb ...
Unpacking libpkcs11-helper1:amd64 (1.11-1) ...
Preparing to unpack .../openssl_1.0.1f-1ubuntu2.15_amd64.deb ...
Unpacking openssl (1.0.1f-1ubuntu2.15) over (1.0.1f-1ubuntu2.11) ...
Selecting previously unselected package openvpn.
Preparing to unpack .../openvpn_2.3.2-7ubuntu3.1_amd64.deb ...
Unpacking openvpn (2.3.2-7ubuntu3.1) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Processing triggers for ureadahead (0.100.0-16) ...
Setting up liblzo2-2:amd64 (2.06-1.2ubuntu1.1) ...
Setting up libpkcs11-helper1:amd64 (1.11-1) ...
Setting up openssl (1.0.1f-1ubuntu2.15) ...
Setting up openvpn (2.3.2-7ubuntu3.1) ...
* Restarting virtual private network daemon(s)... * No VPN is running.
Processing triggers for libc-bin (2.19-0ubuntu6.6) ...
Processing triggers for ureadahead (0.100.0-16) ...
cp: cannot stat ‘/usr/share/doc/openvpn/examples/easy-rsa/’: No such file or directory
--2015-06-29 03:11:40-- https://github.com/OpenVPN/easy-rsa/archive/2.2.2.tar.gz
Resolving github.com (github.com)... 192.30.252.130
Connecting to github.com (github.com)|192.30.252.130|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/OpenVPN/easy-rsa/tar.gz/2.2.2 [following]
--2015-06-29 03:11:40-- https://codeload.github.com/OpenVPN/easy-rsa/tar.gz/2.2.2
Resolving codeload.github.com (codeload.github.com)... 192.30.252.147
Connecting to codeload.github.com (codeload.github.com)|192.30.252.147|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 24453 (24K) [application/x-gzip]
Saving to: ‘/root/easy-rsa.tar.gz’
100%[=========================================================================================================================================>] 24,453 --.-K/s in 0.08s
2015-06-29 03:11:41 (300 KB/s) - ‘/root/easy-rsa.tar.gz’ saved [24453/24453]
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
Using CA Common Name: Fort-Funston CA
Generating a 2048 bit RSA private key
...............................................................+++
.....................................+++
writing new private key to 'ca.key'
-----
Generating a 2048 bit RSA private key
.....................+++
........................................................................+++
writing new private key to 'server.key'
-----
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'SanFrancisco'
organizationName :PRINTABLE:'Fort-Funston'
organizationalUnitName:PRINTABLE:'MyOrganizationalUnit'
commonName :PRINTABLE:'server'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'me@myhost.mydomain'
Certificate is to be certified until Jun 26 07:11:41 2025 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Using Common Name: client
Generating a 2048 bit RSA private key
.........+++
..........................................................+++
writing new private key to 'client.key'
-----
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'SanFrancisco'
organizationName :PRINTABLE:'Fort-Funston'
organizationalUnitName:PRINTABLE:'MyOrganizationalUnit'
commonName :PRINTABLE:'client'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'me@myhost.mydomain'
Certificate is to be certified until Jun 26 07:11:41 2025 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
................................................................................................................+.....................................................................................................................+.....................+.........................................................................................+....................................................+................................................................................+...............+........................................................................................+..................................+.....................................................................................................................................................................................................+................+.........................................................................................................+............+............................................................................................+...................................................................................................................................................................................................+..+..+...........................................+.....................+..........................................................................................+...............................+...............................................+............................................................+..+.....+..........................................................+............................................................................+.....................................................................+.............+...........+.................................................................+..........................................................................................................................................................................+................................................................................................+.............+...........................................................+........................................................+......................................................................+.................................................................................................................................................................................................+...+......................................................+.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+....+............................................................................................................................................................................................................................................................................................................+............................................+............................................................................................................+...+.....................................+...............+..........................................................................+.........................................................................................................+......+...................................................................................................................................................+......+.......................................+.+............................................................................................................................................................................................................+.............................................+.................................................................................................................................................................................................+.......................................+.....................................................................................+......................+.................................................................................................................................................................................................................................+.........................................................................................................................................+................................+.......................................................................................................................................+................++*++*
* Stopping virtual private network daemon(s)... * No VPN is running.
* Starting virtual private network daemon(s)... * Autostarting VPN 'server'
Finished!
Your client config is available at ~/client.ovpn
If you want to add more clients, you simply need to run this script another time!
root@ovpn-test:~# bash openvpn-install.sh
grep: /etc/redhat-release: No such file or directory
Looks like OpenVPN is already installed
What do you want to do?
1) Add a cert for a new user
2) Revoke existing user cert
3) Remove OpenVPN
4) Exit
Select an option [1-4]: 1
Tell me a name for the client cert
Please, use one word only, no special characters
Client name: peter
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
Using Common Name: peter
Generating a 2048 bit RSA private key
.....................................................................................+++
.....................................................+++
writing new private key to 'peter.key'
-----
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'SanFrancisco'
organizationName :PRINTABLE:'Fort-Funston'
organizationalUnitName:PRINTABLE:'MyOrganizationalUnit'
commonName :PRINTABLE:'peter'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'me@myhost.mydomain'
Certificate is to be certified until Jun 26 07:15:58 2025 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Client peter added, certs available at ~/peter.ovpn
root@ovpn-test:~# cat peter.ovpn
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 188.166.77.10 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
<ca>
-----BEGIN CERTIFICATE-----
MIIFEjCCA/qgAwIBAgIJAOuG+8YQ6gHiMA0GCSqGSIb3DQEBCwUAMIG2MQswCQYD
VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMG
A1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXphdGlvbmFsVW5p
dDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdFYXN5UlNBMSEw
HwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW4wHhcNMTUwNjI5MDcxMTQx
WhcNMjUwNjI2MDcxMTQxWjCBtjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUw
EwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsG
A1UECxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3Rv
biBDQTEQMA4GA1UEKRMHRWFzeVJTQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0
Lm15ZG9tYWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6YHBAzrj
ZH4Ti06ocq9J1dWSPKOV5Z/rMierau/4hfVcYgoEC8sICGSXdw2edXTLim5K2ZzC
j67EJjmHVRnLEuGM2ZxDprTsVKPJnq2MYMyOunnZft36byfbFDSQ/JsNttQ0v9jS
Kq6W/hrhVkjhgUrXuEeGMsia/5oixAs9zTPFsb90aMe0rUaJjr+Y9ALrs9ijiFq/
qn1cCHGTyvDlms4uY4Fmh7h37pBy2aml7vGrCHfVtGVmO2lPFOw0OQ/bkwGrQF1q
0DOhvRDALPuk0wIp4m/hEmDaf110aR6o30+Q1g3a7S7iHRn3bJWbv+hLgaS58fxG
YwsTwYdWbvlX4QIDAQABo4IBHzCCARswHQYDVR0OBBYEFJjDMfT+kYtPcz8sNL85
GmquUvpDMIHrBgNVHSMEgeMwgeCAFJjDMfT+kYtPcz8sNL85GmquUvpDoYG8pIG5
MIG2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5j
aXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXph
dGlvbmFsVW5pdDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdF
YXN5UlNBMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW6CCQDrhvvG
EOoB4jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBVTijxMObVZzsw
WEh4qbvSd+ki1l/4/tZgoQcBxrpCpanD2htinAJFO8bCpXqmzH99vpK/N3BiwCwB
NZLM4cxKHOB6skXxiReBY55pNXul/rNpJKfBnGUJJPLo38REn+m37llg4lat9e3y
ZrQe74e8lbihMYOCEtpCKM/NXTQ+qCMnCa9QLhBacLkYUhItVY/l8TRwHHlaGOIL
qLqsC7Gy+dI3IjLGsk3Yy64Lbh9ZeSx2l9JN/RPDdNHYRjNLS8+xNHHI5AhKrxtT
Czf4G5Po2DkhMkgKkUJYtkcs1UCYLZA2RBzPDiscwKaUZhDmO/zVqFsz0rHakGeG
tcyJQzIC
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA/name=EasyRSA/emailAddress=me@myhost.mydomain
Validity
Not Before: Jun 29 07:15:58 2015 GMT
Not After : Jun 26 07:15:58 2025 GMT
Subject: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=peter/name=EasyRSA/emailAddress=me@myhost.mydomain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b5:2b:f2:a5:09:9c:9f:af:75:49:9d:5c:c8:ec:
5e:0b:d2:81:64:82:3d:de:50:37:ed:63:8c:f6:33:
66:07:9b:ec:d7:4f:28:7c:e3:93:70:cf:d9:82:03:
04:82:70:3b:03:94:4a:7f:c1:a8:95:2b:7b:88:24:
ca:0f:bc:ed:9a:46:7a:72:26:c7:5f:c0:3f:5c:ae:
ab:7f:e0:f5:ed:05:7c:a7:15:12:1a:55:80:4d:b4:
a5:80:94:08:b6:65:97:bd:ef:da:ba:fd:21:45:0e:
39:d1:47:0f:ae:56:b4:d8:8f:de:8a:c4:fe:02:98:
3e:a8:71:33:e5:be:d4:fe:1b:b5:41:53:4a:e4:01:
4b:08:00:7d:87:6a:48:9b:c1:e0:46:3f:9f:42:92:
e3:e2:f2:c6:61:ab:38:6d:ae:1a:ef:2d:c6:34:d8:
c6:6b:a3:85:37:24:8d:b6:b2:cd:80:d9:2d:11:a4:
1d:12:b7:f9:05:1c:e4:48:f4:93:11:e7:4e:d8:2a:
a2:6f:aa:12:42:2d:5b:a0:b6:db:d0:31:f9:84:b8:
1f:33:36:6d:82:66:52:a0:e9:41:dc:79:98:92:cf:
5e:2d:6d:f2:b8:34:37:1d:2e:e6:03:8b:76:08:67:
d1:06:f3:9e:14:95:d9:54:65:0d:e3:b9:f0:27:cf:
be:f7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
32:1D:92:17:8C:4B:64:7E:D2:FB:F1:8B:E3:49:A1:9A:73:C0:DB:6E
X509v3 Authority Key Identifier:
keyid:98:C3:31:F4:FE:91:8B:4F:73:3F:2C:34:BF:39:1A:6A:AE:52:FA:43
DirName:/C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=MyOrganizationalUnit/CN=Fort-Funston CA/name=EasyRSA/emailAddress=me@myhost.mydomain
serial:EB:86:FB:C6:10:EA:01:E2
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
61:76:f7:44:a6:2f:54:09:51:27:87:ff:47:61:21:ed:b1:dd:
91:33:80:b0:15:c0:00:d9:ad:91:e9:7f:0a:74:6b:2f:c2:6d:
e6:80:c6:9b:0b:1f:18:4f:c4:c2:b6:de:80:9d:63:d3:b3:11:
53:65:82:40:c0:d2:e8:6b:2f:cc:bd:ab:00:75:56:9f:d4:c3:
bf:ac:f5:fc:a7:d1:30:22:30:22:f4:30:74:da:38:f8:b3:cb:
d1:02:fb:ae:51:5b:ec:37:91:07:8c:c0:35:7c:6a:15:70:db:
a3:9c:e9:ef:8e:fa:6c:80:6c:74:22:39:4c:ba:01:7c:de:8e:
a3:94:50:ae:49:66:e1:a8:7f:b7:e8:aa:67:ce:2c:02:84:58:
e7:7e:1a:5d:36:0b:1a:7f:a7:bd:70:ae:11:71:7e:74:46:df:
00:85:76:98:66:bd:66:50:48:d2:6a:b3:d1:0f:5e:92:9f:23:
23:24:22:40:4a:ca:88:6c:e1:16:0f:0c:e3:49:04:53:58:91:
9a:4f:39:00:3a:cd:9c:94:1a:df:68:57:ad:c2:60:12:6a:ca:
c2:0d:eb:0f:d5:0e:43:13:7d:71:81:94:9f:54:1c:d4:86:55:
b8:8d:21:cb:1f:c0:d0:2e:21:c7:4f:75:5b:bb:53:f7:ee:5e:
63:b6:41:c2
-----BEGIN CERTIFICATE-----
MIIFTjCCBDagAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBtjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAkNBMRUwEwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZv
cnQtRnVuc3RvbjEdMBsGA1UECxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNV
BAMTD0ZvcnQtRnVuc3RvbiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEhMB8GCSqGSIb3
DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluMB4XDTE1MDYyOTA3MTU1OFoXDTI1MDYy
NjA3MTU1OFowgawxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UEBxMM
U2FuRnJhbmNpc2NvMRUwEwYDVQQKEwxGb3J0LUZ1bnN0b24xHTAbBgNVBAsTFE15
T3JnYW5pemF0aW9uYWxVbml0MQ4wDAYDVQQDEwVwZXRlcjEQMA4GA1UEKRMHRWFz
eVJTQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtSvypQmcn691SZ1cyOxeC9KBZII93lA3
7WOM9jNmB5vs108ofOOTcM/ZggMEgnA7A5RKf8GolSt7iCTKD7ztmkZ6cibHX8A/
XK6rf+D17QV8pxUSGlWATbSlgJQItmWXve/auv0hRQ450UcPrla02I/eisT+Apg+
qHEz5b7U/hu1QVNK5AFLCAB9h2pIm8HgRj+fQpLj4vLGYas4ba4a7y3GNNjGa6OF
NySNtrLNgNktEaQdErf5BRzkSPSTEedO2Cqib6oSQi1boLbb0DH5hLgfMzZtgmZS
oOlB3HmYks9eLW3yuDQ3HS7mA4t2CGfRBvOeFJXZVGUN47nwJ8++9wIDAQABo4IB
bTCCAWkwCQYDVR0TBAIwADAtBglghkgBhvhCAQ0EIBYeRWFzeS1SU0EgR2VuZXJh
dGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQyHZIXjEtkftL78YvjSaGac8DbbjCB
6wYDVR0jBIHjMIHggBSYwzH0/pGLT3M/LDS/ORpqrlL6Q6GBvKSBuTCBtjELMAkG
A1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUwEwYDVQQHEwxTYW5GcmFuY2lzY28xFTAT
BgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsGA1UECxMUTXlPcmdhbml6YXRpb25hbFVu
aXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3RvbiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEh
MB8GCSqGSIb3DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluggkA64b7xhDqAeIwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IB
AQBhdvdEpi9UCVEnh/9HYSHtsd2RM4CwFcAA2a2R6X8KdGsvwm3mgMabCx8YT8TC
tt6AnWPTsxFTZYJAwNLoay/MvasAdVaf1MO/rPX8p9EwIjAi9DB02jj4s8vRAvuu
UVvsN5EHjMA1fGoVcNujnOnvjvpsgGx0IjlMugF83o6jlFCuSWbhqH+36KpnziwC
hFjnfhpdNgsaf6e9cK4RcX50Rt8AhXaYZr1mUEjSarPRD16SnyMjJCJASsqIbOEW
DwzjSQRTWJGaTzkAOs2clBrfaFetwmASasrCDesP1Q5DE31xgZSfVBzUhlW4jSHL
H8DQLiHHT3Vbu1P37l5jtkHC
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC1K/KlCZyfr3VJ
nVzI7F4L0oFkgj3eUDftY4z2M2YHm+zXTyh845Nwz9mCAwSCcDsDlEp/waiVK3uI
JMoPvO2aRnpyJsdfwD9crqt/4PXtBXynFRIaVYBNtKWAlAi2ZZe979q6/SFFDjnR
Rw+uVrTYj96KxP4CmD6ocTPlvtT+G7VBU0rkAUsIAH2HakibweBGP59CkuPi8sZh
qzhtrhrvLcY02MZro4U3JI22ss2A2S0RpB0St/kFHORI9JMR507YKqJvqhJCLVug
ttvQMfmEuB8zNm2CZlKg6UHceZiSz14tbfK4NDcdLuYDi3YIZ9EG854UldlUZQ3j
ufAnz773AgMBAAECggEAcLBRUQ5VeY3takiTOfar2Laq/RV13h4Pa30MZOc7g2gd
PR9jk6sKPpVKOXAfEfM1AdjvLeALOB2/zML1XCyrrdZAu1gbkxdFUiTjT7thvHg5
PMQCapbcI3lFqGBruugeJmpWpxBj7UwX8nA89LfB7SIvzikRxhNkhelD2peEbDlK
lpBsy0DtjLvc2XpJWlCt4MYoRaW1qMZF1H7SrZdTVaQg3CQoj1smeyAjKx4/XXXn
kZznYgn4XCsmj3ao1z5QFdyp4nPuc+GXDiu+Rsg9At4ImhW/1zXmaRlPL84Pt5ko
RXDA6WS9v+A0yGpXgHxeKAyfsaLmunX0N8mdW9D6wQKBgQDuECQXeSBnhNEzBul0
NWtiZMfKbXDD5L0o9wxWjjO7c71czmZszOcsPB93IJyVpYsL9oMNpz7fDiV88OCR
bVf0qOU8BRGhYBK+hpmle63SLYvk0jvmF4DtPKyzLt3XZ8cmdHnwtDMSDU4T7SjN
S9JFVjIG05VsmCSLRAoASxtPmQKBgQDC0nZYZX3vaLL8fsztFtHUqXMnBu8pEifB
36bM5R4TVjbe6Spzn12VJ33GwkoZ1wBtEo9oM4WYoemYdndHkMVDs3LrYhfrmLpC
XoyROWu89kpGb48HDBtLOPs3x8ac1XeZ+fUy6UQlTzGnQOtdIdgytkpSXDDHYrgk
FeQ0dNfdDwKBgHG2NAciTGAmCOcevhRMD+cHzIbcj6iCcfhHSRVvBzbaqfDShgoi
NanjbgQxB5pTYH9uWFsFL/rLfwyW4i2U1RaANj7dDPbQNSPclzd8RCLIrrG12fal
82deO/+6uyxQ3cd4i2Z2LI7K3CiYd4zYUq/b5Dluh0k/wvTiowRQ29LBAoGBAIGF
TiyCfPEXWDdJTZAp5aJObUH6+DED4u6fc9MwV4hffuc/eHuZ7atlr9beAEmhiKT6
++A4sI7CxfwYdkBb3Omfeb1HX8O/q8TH+wfpdtkPnF2reRkkUVj3LvzskfxeZr81
UHBiaG2tcsNRA6jNAWDllA+hPsSvuuAytZ6yN3i9AoGBAJCXSPrYJEPbGSR7GOOr
iHr3PUy9E3Lh/bA7FEIdar925e8yBRdp8HaVx7qmsnhRJOn8YMfPJL8gOOG5rQVG
UvDexo9Ztrm80SZ8XTNlDNh9cIRpI5x3rwGCG/Xh2BqybLrb+zl3MB9NIBwm9LEp
1CePEy3Opy3/ku7w5fm7/E1I
-----END PRIVATE KEY-----
</key>
root@ovpn-test:~# bash openvpn-install.sh
grep: /etc/redhat-release: No such file or directory
Looks like OpenVPN is already installed
What do you want to do?
1) Add a cert for a new user
2) Revoke existing user cert
3) Remove OpenVPN
4) Exit
Select an option [1-4]: 2
Tell me the existing client name
Client name: peter
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
Revoking Certificate 03.
Data Base Updated
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
peter.crt: C = US, ST = CA, L = SanFrancisco, O = Fort-Funston, OU = MyOrganizationalUnit, CN = peter, name = EasyRSA, emailAddress = me@myhost.mydomain
error 23 at 0 depth lookup:certificate revoked
* Stopping virtual private network daemon(s)... * Stopping VPN 'server' [ OK ]
* Starting virtual private network daemon(s)... * Autostarting VPN 'server'
Certificate for client peter revoked
root@ovpn-test:~# bash openvpn-install.sh
grep: /etc/redhat-release: No such file or directory
Looks like OpenVPN is already installed
What do you want to do?
1) Add a cert for a new user
2) Revoke existing user cert
3) Remove OpenVPN
4) Exit
Select an option [1-4]: 1
Tell me a name for the client cert
Please, use one word only, no special characters
Client name: peter
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
Using Common Name: peter
Generating a 2048 bit RSA private key
.+++
............................................................................................................................+++
writing new private key to 'peter.key'
-----
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'SanFrancisco'
organizationName :PRINTABLE:'Fort-Funston'
organizationalUnitName:PRINTABLE:'MyOrganizationalUnit'
commonName :PRINTABLE:'peter'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'me@myhost.mydomain'
Certificate is to be certified until Jun 26 07:16:25 2025 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Client peter added, certs available at ~/peter.ovpn
root@ovpn-test:~# cat peter.ovpn
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 188.166.77.10 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
<ca>
-----BEGIN CERTIFICATE-----
MIIFEjCCA/qgAwIBAgIJAOuG+8YQ6gHiMA0GCSqGSIb3DQEBCwUAMIG2MQswCQYD
VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMG
A1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXphdGlvbmFsVW5p
dDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdFYXN5UlNBMSEw
HwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW4wHhcNMTUwNjI5MDcxMTQx
WhcNMjUwNjI2MDcxMTQxWjCBtjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUw
EwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsG
A1UECxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3Rv
biBDQTEQMA4GA1UEKRMHRWFzeVJTQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0
Lm15ZG9tYWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6YHBAzrj
ZH4Ti06ocq9J1dWSPKOV5Z/rMierau/4hfVcYgoEC8sICGSXdw2edXTLim5K2ZzC
j67EJjmHVRnLEuGM2ZxDprTsVKPJnq2MYMyOunnZft36byfbFDSQ/JsNttQ0v9jS
Kq6W/hrhVkjhgUrXuEeGMsia/5oixAs9zTPFsb90aMe0rUaJjr+Y9ALrs9ijiFq/
qn1cCHGTyvDlms4uY4Fmh7h37pBy2aml7vGrCHfVtGVmO2lPFOw0OQ/bkwGrQF1q
0DOhvRDALPuk0wIp4m/hEmDaf110aR6o30+Q1g3a7S7iHRn3bJWbv+hLgaS58fxG
YwsTwYdWbvlX4QIDAQABo4IBHzCCARswHQYDVR0OBBYEFJjDMfT+kYtPcz8sNL85
GmquUvpDMIHrBgNVHSMEgeMwgeCAFJjDMfT+kYtPcz8sNL85GmquUvpDoYG8pIG5
MIG2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5j
aXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXph
dGlvbmFsVW5pdDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdF
YXN5UlNBMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW6CCQDrhvvG
EOoB4jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBVTijxMObVZzsw
WEh4qbvSd+ki1l/4/tZgoQcBxrpCpanD2htinAJFO8bCpXqmzH99vpK/N3BiwCwB
NZLM4cxKHOB6skXxiReBY55pNXul/rNpJKfBnGUJJPLo38REn+m37llg4lat9e3y
ZrQe74e8lbihMYOCEtpCKM/NXTQ+qCMnCa9QLhBacLkYUhItVY/l8TRwHHlaGOIL
qLqsC7Gy+dI3IjLGsk3Yy64Lbh9ZeSx2l9JN/RPDdNHYRjNLS8+xNHHI5AhKrxtT
Czf4G5Po2DkhMkgKkUJYtkcs1UCYLZA2RBzPDiscwKaUZhDmO/zVqFsz0rHakGeG
tcyJQzIC
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4 (0x4)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA/name=EasyRSA/emailAddress=me@myhost.mydomain
Validity
Not Before: Jun 29 07:16:25 2015 GMT
Not After : Jun 26 07:16:25 2025 GMT
Subject: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=peter/name=EasyRSA/emailAddress=me@myhost.mydomain
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:e0:ea:f8:19:9a:da:b2:63:c5:b0:a7:27:ef:43:
57:24:a8:12:3f:61:46:13:e6:0a:c5:da:4d:2c:10:
12:2b:45:f8:38:ef:3a:ab:d5:71:ae:ff:60:91:de:
21:20:d6:c7:72:ef:8e:7d:ed:c6:2e:46:82:b0:df:
cb:9c:f1:5b:ec:cb:72:4a:ff:0a:49:7a:bb:e6:b3:
18:ab:66:be:5f:d2:e8:b6:20:5d:54:b9:ea:d1:40:
03:d3:fb:5c:5c:48:b0:b5:18:4a:ee:64:3e:f6:4c:
ca:72:2e:9f:1c:fa:1d:07:5a:ce:46:5c:2d:9e:e7:
a2:c5:25:c9:36:f0:33:94:5d:a4:b2:ad:ad:71:08:
13:83:f0:04:9e:70:28:a9:a6:10:e4:b1:f5:4f:45:
de:fa:a7:8c:e9:59:38:4b:32:76:47:d5:06:c9:fe:
43:63:cc:21:0b:43:68:14:60:69:af:b7:5e:b8:a2:
5f:38:c6:bb:8a:b4:07:09:87:f8:6c:ce:b7:bb:ff:
ff:e3:88:59:df:89:f9:0b:12:b6:ac:ac:4c:5e:fb:
08:40:1c:56:56:28:16:a8:7f:c0:33:08:84:01:94:
5f:0f:7e:fc:ac:87:90:ee:dc:40:1c:64:b6:99:9f:
f1:60:dd:2e:c6:67:be:1e:1f:49:b5:81:f7:e2:27:
e2:91
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
63:A3:42:0B:14:F3:39:20:6E:14:CD:94:C5:AF:87:67:86:CD:D2:E7
X509v3 Authority Key Identifier:
keyid:98:C3:31:F4:FE:91:8B:4F:73:3F:2C:34:BF:39:1A:6A:AE:52:FA:43
DirName:/C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=MyOrganizationalUnit/CN=Fort-Funston CA/name=EasyRSA/emailAddress=me@myhost.mydomain
serial:EB:86:FB:C6:10:EA:01:E2
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
54:18:57:db:05:4f:03:1a:e1:8e:76:77:fd:72:c3:49:64:97:
4d:b9:95:0d:0c:67:83:27:b8:69:56:4c:99:d3:7b:96:d1:89:
5b:ce:97:56:1f:0e:4e:c3:a5:79:18:ef:32:09:84:d1:61:02:
c9:71:80:ab:d8:5a:40:95:22:7d:25:dd:93:02:5a:d7:b0:bd:
34:40:be:34:a6:73:c6:8f:49:4d:be:24:1d:3c:4d:53:85:22:
2b:a5:7c:d2:5a:fd:9a:c7:5f:8b:4b:ee:05:e5:d9:83:07:df:
af:8b:d8:44:2d:68:6a:ae:7e:db:b9:0b:1a:9b:f2:3d:89:36:
e2:a5:da:88:e4:49:34:81:03:a7:b9:c4:e2:82:e6:c3:2b:31:
85:8b:88:9e:87:89:44:72:50:87:5e:5f:e3:83:b1:0a:ea:2f:
8f:91:63:62:28:b7:6a:f8:28:c3:e3:64:8f:2d:d9:39:a0:9d:
0a:46:97:4a:ee:44:2e:3d:30:86:d2:f8:a3:9c:d4:7d:52:fd:
5f:0a:de:12:bd:12:d1:98:65:16:94:40:0c:03:c5:15:35:66:
79:05:64:0e:34:17:e0:84:20:9b:f9:dc:a1:40:39:f5:2b:e0:
77:8a:d4:4f:64:a9:d5:6a:cd:1f:7f:ee:ea:10:af:61:74:d3:
af:e4:11:38
-----BEGIN CERTIFICATE-----
MIIFTjCCBDagAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBtjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAkNBMRUwEwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZv
cnQtRnVuc3RvbjEdMBsGA1UECxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNV
BAMTD0ZvcnQtRnVuc3RvbiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEhMB8GCSqGSIb3
DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluMB4XDTE1MDYyOTA3MTYyNVoXDTI1MDYy
NjA3MTYyNVowgawxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UEBxMM
U2FuRnJhbmNpc2NvMRUwEwYDVQQKEwxGb3J0LUZ1bnN0b24xHTAbBgNVBAsTFE15
T3JnYW5pemF0aW9uYWxVbml0MQ4wDAYDVQQDEwVwZXRlcjEQMA4GA1UEKRMHRWFz
eVJTQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Or4GZrasmPFsKcn70NXJKgSP2FGE+YK
xdpNLBASK0X4OO86q9Vxrv9gkd4hINbHcu+Ofe3GLkaCsN/LnPFb7MtySv8KSXq7
5rMYq2a+X9LotiBdVLnq0UAD0/tcXEiwtRhK7mQ+9kzKci6fHPodB1rORlwtnuei
xSXJNvAzlF2ksq2tcQgTg/AEnnAoqaYQ5LH1T0Xe+qeM6Vk4SzJ2R9UGyf5DY8wh
C0NoFGBpr7deuKJfOMa7irQHCYf4bM63u///44hZ34n5CxK2rKxMXvsIQBxWVigW
qH/AMwiEAZRfD378rIeQ7txAHGS2mZ/xYN0uxme+Hh9JtYH34ifikQIDAQABo4IB
bTCCAWkwCQYDVR0TBAIwADAtBglghkgBhvhCAQ0EIBYeRWFzeS1SU0EgR2VuZXJh
dGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRjo0ILFPM5IG4UzZTFr4dnhs3S5zCB
6wYDVR0jBIHjMIHggBSYwzH0/pGLT3M/LDS/ORpqrlL6Q6GBvKSBuTCBtjELMAkG
A1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUwEwYDVQQHEwxTYW5GcmFuY2lzY28xFTAT
BgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsGA1UECxMUTXlPcmdhbml6YXRpb25hbFVu
aXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3RvbiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEh
MB8GCSqGSIb3DQEJARYSbWVAbXlob3N0Lm15ZG9tYWluggkA64b7xhDqAeIwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IB
AQBUGFfbBU8DGuGOdnf9csNJZJdNuZUNDGeDJ7hpVkyZ03uW0YlbzpdWHw5Ow6V5
GO8yCYTRYQLJcYCr2FpAlSJ9Jd2TAlrXsL00QL40pnPGj0lNviQdPE1ThSIrpXzS
Wv2ax1+LS+4F5dmDB9+vi9hELWhqrn7buQsam/I9iTbipdqI5Ek0gQOnucTigubD
KzGFi4ieh4lEclCHXl/jg7EK6i+PkWNiKLdq+CjD42SPLdk5oJ0KRpdK7kQuPTCG
0vijnNR9Uv1fCt4SvRLRmGUWlEAMA8UVNWZ5BWQONBfghCCb+dyhQDn1K+B3itRP
ZKnVas0ff+7qEK9hdNOv5BE4
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDg6vgZmtqyY8Ww
pyfvQ1ckqBI/YUYT5grF2k0sEBIrRfg47zqr1XGu/2CR3iEg1sdy74597cYuRoKw
38uc8Vvsy3JK/wpJervmsxirZr5f0ui2IF1UuerRQAPT+1xcSLC1GEruZD72TMpy
Lp8c+h0HWs5GXC2e56LFJck28DOUXaSyra1xCBOD8ASecCipphDksfVPRd76p4zp
WThLMnZH1QbJ/kNjzCELQ2gUYGmvt164ol84xruKtAcJh/hszre7///jiFnfifkL
ErasrExe+whAHFZWKBaof8AzCIQBlF8Pfvysh5Du3EAcZLaZn/Fg3S7GZ74eH0m1
gffiJ+KRAgMBAAECggEAS6Zcemg+ZL/wL0GZyf0RY2/wa0bxhiHav790M3zYT5vC
KIw2ZLNvAFg/B/D5nY0AGqV+fNar0MbAkHNFje0UaSnosFbmA973MlpM0uHE6IAM
660pFyVNWMI6R2OFJjkAznh0Q4iOMNOVSCBsPhfWCbI+LSY15futILhb3FGgV6ci
IZqEzQKe9TNIRhAWBxZuR3dKxHMPg9FKxL6FlaEPyH59ZmY5fOnV8ocFxL4/ssmH
qaL1Xume6n0E4ynCx86Q7y3bpXwFnEirgrZK7Vay6R9Dz7qJPM//Zhr76jatm5Ij
ABUrIJ35/CsSwH6LnS9in4Lh86tsQVj1tAq5VxUeAQKBgQDxOu1Jv+w7iWXFaLF0
Z1Ji8L/TeR1HUbXl9RzLIXoifl+VUxiCeUw7LK78bJzLOtH2xRcKEfXDf6iaFT/0
gtUPd/QCLEYiLFhIztQrH62AJ+33IQ7u4YvXZyoLI55dB4Lfg2irWECdAZicTKFx
yLhYWhu+ykm0tfyY5sIWMwevsQKBgQDusFxPTb+8buIHcuAFzuerDPpu6GfXQf22
QqveCM+emIEF9UItKlYONgrpS29wIRnTLanXdVwOX/zbkn+TYfC6uQ6SQyMyRdki
+VEqf+k6bkiZa1mf/5acrKEFimV/S70VX19jb/l7kp5vurQoflHmXOxSQlFM4oSO
9Cnu4SP44QKBgQCG8GOUAZvvoeggCXRanQFk/y8O6I0MPBT4UaiNqGhdqztkmFr5
gUi3QUORSGBc/sY8t/svUuSbO2ng50ojSJxOTtdb79A7hXrNH4Vnqgyvx6ZBu2hT
EC/dioPmP0Jy36TBywxd7LwYF7B6nhMhRxp3sdAbZaTdRX/LOCoRqPH/wQKBgE6k
ivWSH19dhVmA7vDa+BeyofzS1AvncUmQ9AGnE4kkpDYrVc99yHbMNZIiSag/L7wV
qoUT5O3TkINj5GbR+Tf8ayGjvz/8JYvRa32+QUEAPylVZmVCGAStGCy0KbbkZHtb
PhmMNj4R0+PqNxu0axWkfjSoJxNW+ugC6KINSgXhAoGAMHp1i4hKgkXhsREFYGOI
qlxYaLqzBAIRm1GXGDqr/3l8GTAxtYzivp2kh2j6bvJFjrLL7W+kOIkizxyrXqGE
tGZb3Nr/yaafRli3zIKugwoxp/YZxmG1/PU1+xkWos03k7nShxEqD+fV7jfZrJbu
VfdaZluX6zGdPHoGd8Qh4Wg=
-----END PRIVATE KEY-----
</key>
root@ovpn-test:~# 
sveip
serjo96
If I run the script and select "1" to add a new user with name "peter" no certificate is added to the ovpn file.
Output:
I've tried to remove it first, as well as deleting the files manually.
Creating other users does not lead to the same problem.