Cette procédure est destiner aux administrateurs roots et leurs permet de signer des certificats OpenVPN pour permettre a des clients de se connecter aux VPN.
Importer le certificat
# ./easyrsa import-req <fichier_csr_fourni_par_l_utilisateur>.csr <hruid_de_l_utilisateur>@<nom_machine_de_l_utilisateur> Note: using Easy-RSA configuration from: ./vars The request has been successfully imported with a short name of: mathieu.goulin@magritte You may now use this name to perform signing operations on this request.
Signer le certificat
[ root@charon ] (12:31:21:!511) ~/easyrsa3
# ./easyrsa sign-req client <hruid_de_l_utilisateur>@<nom_machine_de_l_utilisateur>
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 36500 days:
subject=
countryName = FR
stateOrProvinceName = Some-State
localityName = Metz
organizationName = Arts et Metiers Allumni
organizationalUnitName = Gadz.org
commonName = mathieu.goulin.2008@magritte
emailAddress = [email protected]
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /root/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /root/easyrsa3/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'FR'
stateOrProvinceName :ASN.1 12:'Some-State'
localityName :ASN.1 12:'Metz'
organizationName :ASN.1 12:'Arts et Metiers Allumni'
organizationalUnitName:ASN.1 12:'Gadz.org'
commonName :ASN.1 12:'mathieu.goulin.2008@magritte'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Apr 14 10:31:32 2116 GMT (36500 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /root/easyrsa3/pki/issued/[email protected]