easy-rsa

See also easy-rsa https://github.com/OpenVPN/easy-rsa

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://github.com/smallstep / https://smallstep.com/docs/step-ca/ * https://github.com/OpenVPN/easy-rsa * https://hohnstaedt.de/xca/ * https://github.com/FiloSottile/mkcert (good for on-one-host dev stuff)

Easy-rsa to the rescue. Been using it for a while, works great and makes life easier :) Link: https://github.com/OpenVPN/easy-rsa Summary from that page: easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).

Depending on the criticity of your protected service, you could probably just be your own Certificate Authority, and publish the root certificate internally. How many machines are we talking about? A local PKI is probably overkill. Do you intend to give every single coworker a certificate on their own smartcard? If not, PKI is most probably not needed. https://github.com/OpenVPN/easy-rsa + two USB thumb drives in a safe (primary + backup) + one off-site in another safe. Client certificates are kind of hard to ask a global PKI for, because you usually use some internal names, not public FQDNs...

Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa. Initially they used to come as a goodies with OpenVPN, but they are now provided as a standalone project. There are already packaged and available in most distributions (easy-rsa package under Debian for example). There are probably a little bit more complex to use, but it's far from horrible, and it's quite battle tested.

You can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa

Looking that the easy-rsa 3 script that now comes bundled with OpenVPN, that value is set to 2048 bits: set_var EASYRSA_KEY_SIZE 2048 # gen-dh backend: gen_dh() { verify_pki_init local out_file="$EASYRSA_PKI/dh.pem" "$EASYRSA_OPENSSL" dhparam -out "$out_file" $EASYRSA_KEY_SIZE || \ die "Failed to build DH params" notice "\ https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/eas...

Easy-rsa[1] (OpenVPN's key/cert generation/signing tool) version 3 will generate a 2048 bit diffie hellman key by default. Previous versions of easy-rsa used 1024 bit as default. Here is a comment written in the vars configuration file for easy-rsa 2.2.2: # Increase this to 2048 if you # are paranoid. This will slow # down TLS negotiation performance # as well as the one-time DH parms # generation process. export KEY_SIZE=1024 So if you used easy-rsa version 2.2.2 or previous to generate your diffie hellman key for the server, and didn't increase the default size in the vars file before doing so, your server uses a 1024 bit diffie hellman key. [1]https://github.com/OpenVPN/easy-rsa

While not the only one out there[1], I've been hacking a cli tool written in bash[2] to streamline the OpenSSL commands geared toward a PKI/CA workflow. I started it mainly for my overall learning of OpenSSL from nothing and for my small scale needs with my CoreOS servers. What I learned from this exercise, is that it's not the complexity of the commands that is the issue with OpenSSL, it's: 1) The importance of consistent naming schemes (for the humans) and PKI hierarchy design (the nuances of keyUsage, basicConstraints, and extendedKeyUsage) 2) consistent execution of commands; typos are more likely the more you have to put in the CLI manually 3) good configuration files aren't utilized enough in most of the tutorials I found. They can streamline use, archive procedure, and prevent typos as in point #2. 4) The importing of certs and key

From the TLS sysadmin deployment guide(https://weakdh.org/sysadmin.html): > Generate a Strong, Unique Diffie Hellman Group. A few fixed groups are used by millions of servers, which makes them an optimal target for precomputation, and potential eavesdropping. Administrators should generate unique, 2048-bit or stronger Diffie-Hellman groups using "safe" primes for each website or server. Is this why with the easy-rsa package (https://github.com/OpenVPN/easy-rsa) one should always build a dh pair first? People are using pre-seeded ones when they do not use this tool first!? That is scary.

Cool guide, makes me want to learn more about BSD and pf. I've been doing this but with a Linux VPS, iptables and EasyRSA3[0][1]. [0]https://github.com/OpenVPN/easy-rsa [1]https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-....

I'd suggest to rather use easy-rsa[1] because wrestling bare OpenSSL is not something you want to do unless you absolutely have to. [1] https://github.com/OpenVPN/easy-rsa/blob/master/doc/EasyRSA-...