search

TinCanTech / easy-tls

Manage and Inline OpenVPN TLS keys and Easy-RSA PKI credentials. Supports OpenVPN TLS-Crypt-V2 key system and OpenVPN Peer-Fingerprint mode.
GNU General Public License v2.0
87 stars 19 forks source link

Why is easy-tls needed? #308

Open c-git opened 9 months ago

c-git commented 9 months ago

Sorry to ask a probably obvious question to other people, but I haven't quite been able to understand. I read the readme but wasn't able to figure out the answer to my question. Also tried googling but also wasn't able to find an answer.

What happens if you follow the EasyRSA3 Howto and don't do the easytls part?

I'm using the first version with separate CA. I get the impression it is needed for both approaches but I don't quite understand what it accomplishes. Does the VPN not work or is it insecure if this part is not done?

TinCanTech commented 9 months ago

The essential use for Easy-TLS is to create TLS-Crypt-V2 Server and Client keys. Then build inline files with matching X509 details to OpenVPN TLS-Crypt-V2 key details.

The command to try is build, which will invoke an interactive menu layer to help guide you.

There are some rough edges ...

And also, you do not require Easy-TLS to use OpenVPN or Easy-RSA.

c-git commented 9 months ago

Thanks, I'll play with it a bit more and see if I can understand. I don't quite get what will happen if I don't use it.