[root@myvpn ~]# docker-compose run --rm openvpn ovpn_initpki init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/pki Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020 Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: Generating RSA private key, 2048 bit long modulus (2 primes) ...+++++ .............................................+++++ e is 65537 (0x010001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:myvpn CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/pki/ca.crt Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ..+.......................................................................................................................+.............................. ................+..........+.....+......................................................................................+............................+... ...........................................................+........................................................................+.................... ...............................................................................................................................+......................... ....................+...........................................................+....................+........+.......................................... .............................................+.............................................+............................................................. ...............................................................................................................+......................................... ............................................+...........................+..........................................................+..................... .........................................+............................................................................................................... .+....................................................................................................................................................... ...........................................................+.................+............................................................+.............. .................................................................................+....................................................................... .............+........................................................................................................................................... ..................+...........................................................+.....................................................................+.... ...............+.......................+...................................................................................................+............. ............+...................+........................................................................................................................ ......................................................................................................................................+..........+....... ......................................................................................................................................................... ...............................................................+......................................................................................... ...................+...........................................................................+......................................................... ......................................................................................................................................................... ............................................................................................................................................+............ ......................................................................................................................................................... .............................+.....+................................................................................................+.................... ...................................................................+...............+........+............................................................ ..................................+...................................................................................................................... ......+...............................................................................................................+.................................. ..........+............+.+....................+.................................+..........+...................................................+......... ......................................................................................................................................................... ..+.............+........................................................................................................+.....................+......... ......................................................................................................................................................... ......................................................................+.......................+.......................................................... ...............+....................................................+.................................................................................... ............................................+............................................................................................................ +...............................+........................................................................................................................ ...........................................+...+...........+............................................................................................. ......................................+........+.....................+............................+..+............................+.................+.... ....................................................+.................................................................................................... ..................+...................................................................................................................................... ......................................................................................................................................................... ................+..................++*++*++*++* DH parameters of size 2048 created at /etc/openvpn/pki/dh.pem Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020 Generating a RSA private key .................................................................................................+++++ .................+++++ writing new private key to '/etc/openvpn/pki/easy-rsa-72.oGGNiF/tmp.iIHDPh' ----- Using configuration from /etc/openvpn/pki/easy-rsa-72.oGGNiF/tmp.EoOebI Enter pass phrase for /etc/openvpn/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'owenouyang.ga' Certificate is to be certified until Jul 31 03:10:24 2023 GMT (825 days) Write out database with 1 new entries Data Base Updated Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020 Using configuration from /etc/openvpn/pki/easy-rsa-147.LPbjaB/tmp.CCKLEa Enter pass phrase for /etc/openvpn/pki/private/ca.key: An updated CRL has been created. CRL file: /etc/openvpn/pki/crl.pem
啟動 OpenVPN Server
1
$ docker-compose up -d openvpn
製作用戶端連線描述檔案
1
$ export CLIENTNAME="myvpn"
設定等等輸出的用戶端資訊，建立一組需要密碼的用戶端
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
$ docker-compose run --rm openvpn easyrsa build-client-full "$CLIENTNAME" Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020 Generating a RSA private key ...............+++++ ...............+++++ writing new private key to '/etc/openvpn/pki/easy-rsa-1.AFgNIn/tmp.OpMLbP' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- Using configuration from /etc/openvpn/pki/easy-rsa-1.AFgNIn/tmp.PielgE Enter pass phrase for /etc/openvpn/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'myvpn' Certificate is to be certified until Jul 31 03:25:39 2023 GMT (825 days) Write out database with 1 new entries Data Base Updated
特別注意，如果這邊輸入錯誤的驗證密碼，這組就會失效，請用別的名字 CLIENTNAME 再試一次！
1
$ docker-compose run --rm openvpn ovpn_getclient "$CLIENTNAME" > "$CLIENTNAME.ovpn"
把 OpenVPN 連線的檔案抽取出來，這檔案就可以用來連線囉！
由於他這產生的憑證有效期是三年（會看到提示），要簽過就是跑上述流程，而廢止需要參考下方指令。
1
$ docker-compose run --rm openvpn ovpn_revokeclient "$CLIENTNAME"