easy-rsa

Easy-rsa[1] (OpenVPN's key/cert generation/signing tool) version 3 will generate a 2048 bit diffie hellman key by default. Previous versions of easy-rsa used 1024 bit as default. Here is a comment written in the vars configuration file for easy-rsa 2.2.2: # Increase this to 2048 if you # are paranoid. This will slow # down TLS negotiation performance # as well as the one-time DH parms # generation process. export KEY_SIZE=1024 So if you used easy-rsa version 2.2.2 or previous to generate your diffie hellman key for the server, and didn't increase the default size in the vars file before doing so, your server uses a 1024 bit diffie hellman key. [1]https://github.com/OpenVPN/easy-rsa

While not the only one out there[1], I've been hacking a cli tool written in bash[2] to streamline the OpenSSL commands geared toward a PKI/CA workflow. I started it mainly for my overall learning of OpenSSL from nothing and for my small scale needs with my CoreOS servers. What I learned from this exercise, is that it's not the complexity of the commands that is the issue with OpenSSL, it's: 1) The importance of consistent naming schemes (for the humans) and PKI hierarchy design (the nuances of keyUsage, basicConstraints, and extendedKeyUsage) 2) consistent execution of commands; typos are more likely the more you have to put in the CLI manually 3) good configuration files aren't utilized enough in most of the tutorials I found. They can streamline use, archive procedure, and prevent typos as in point #2. 4) The importing of certs and key

From the TLS sysadmin deployment guide(https://weakdh.org/sysadmin.html): > Generate a Strong, Unique Diffie Hellman Group. A few fixed groups are used by millions of servers, which makes them an optimal target for precomputation, and potential eavesdropping. Administrators should generate unique, 2048-bit or stronger Diffie-Hellman groups using "safe" primes for each website or server. Is this why with the easy-rsa package (https://github.com/OpenVPN/easy-rsa) one should always build a dh pair first? People are using pre-seeded ones when they do not use this tool first!? That is scary.

Cool guide, makes me want to learn more about BSD and pf. I've been doing this but with a Linux VPS, iptables and EasyRSA3[0][1]. [0]https://github.com/OpenVPN/easy-rsa [1]https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-....

I'd suggest to rather use easy-rsa[1] because wrestling bare OpenSSL is not something you want to do unless you absolutely have to. [1] https://github.com/OpenVPN/easy-rsa/blob/master/doc/EasyRSA-...