|
5、使用clean-all脚本清除包括CA在内的所有证书,再创建CA证书.
[root@dic172 easy-rsa]# ./clean-all #先清除证书,再创建证书
[root@dic172 easy-rsa]# ./build-ca #创建CA证书
Generating a 1024 bit RSA private key
..........
................
writing new private key to ''ca.key''
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ''.'', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server''s hostname) []:dic172 #服务器主机名
Email Address [tghfly222@126.com]:
6、创建服务器密钥.
[root@dic172 easy-rsa]# ./build-key-server server #创建服务器端密钥
Generating a 1024 bit RSA private key
............................................
....
writing new private key to ''server.key''
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ''.'', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server''s hostname) []:dic172 #服务器主机名
Email Address [tghfly222@126.com]:
Please enter the following ''extra'' attributes
to be sent with your certificate request
A challenge password []:dic172
An optional company name []:dic172
Using configuration from /usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject''s Distinguished Name is as follows
countryName :PRINTABLE:''CN''
stateOrProvinceName :PRINTABLE:''GD''
localityName :PRINTABLE:''SZ''
organizationName :PRINTABLE:''DIC''
commonName :PRINTABLE:''dic172''
emailAddress :IA5STRING:''tghfly222@126.com''
Certificate is to be certified until Jul 16 05:51:08 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
7、创建客户端密钥,客户端密钥名可随意命名.
[root@dic172 easy-rsa]# ./build-key client
remote 192.168.161.172 1194
resolv-retry infinite
nobind
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
comp-lzo
verb 3
mute 20
5、启动连接.右击右下角的OpenVPN GUI图标,连接
6、连接成功后,图标如下.到此,SSL VPN服务就配置好了.
|
