Configuring OpenVPN on EdgeRouter — my updates to original tutorial and some solutions related with certificates

I used this original tutorial but during deployment I made some improvements/updates. Here they are:

1. I did not carry out the last instruction from point 19 and the instruction from point 21.
2. On the client side, I had to explicitly specify the AES-256-GCM cipher algorithm in the .ovpn file using cipher AES-256-GCM.
3. The network address for use by OpenVPN clients in point 19 is 10.100.0.0/24 → set interfaces openvpn vtun0 server subnet 10.100.0.0/24.
4. I also had to restart the vtun0 interface by performing the following steps in sequence:

configure

set interfaces openvpn vtun0 disable

commit

delete interfaces openvpn vtun0 disable

commit

5. In configure mode configure I added explicitly set interfaces openvpn vtun0 openvpn-option "--cipher AES-256-GCM".

6. For debugging purposes, I used level 7 (default mode 3) set interfaces openvpn vtun0 openvpn-option "--verb 7".

7. If all traffic need to be redirected (in other words, whole traffic to the Internet will be pushed through the VPN tunnel), add redirect-gateway def1 to the configuration (.ovpn) file on the client.

I did not find on the Internet a way to renew specific openvpn client certificate on the EdgeRouter. I have tried on my own and I found the solution. In the following example, I am renewing my certificate. Each person has own one.

1. Checking certificate validity:

openssl x509 -noout -text -in pbracha.pem | grep -i -A2 validity

2. Exporting “CSR” from the expiring certificate to the newreq.pem file. Executed on the router in the /config/auth/ path:

openssl x509 -x509toreq -in pbracha.pem -signkey pbracha.key -out newreq.pem

3. Moving the newreq.pem file to the /usr/lib/ssl/misc/ directory:

mv newreq.pem /usr/lib/ssl/misc/

4. Copy pbracha.key with the required name and place it in the target directory:

cp /config/auth/pbracha.key /usr/lib/ssl/misc/newkey.pem

5. [Optional — if you cannot sign the certificate in the next step] Go to the /usr/lib/ssl/misc/ directory and revoke the current certificate:

cd /usr/lib/ssl/misc/
./CA.pl -revoke /config/auth/pbracha.pem

6. Go to the /usr/lib/ssl/misc/ directory, change the owner of the newreq.pem file to root:root, and start signing:

cd /usr/lib/ssl/misc/
chown root:root newreq.pem
./CA.pl -sign

7. Moving generated files to the /config/auth/ path:

mv newcert.pem /config/auth/pbracha.pem
mv newkey.pem /config/auth/pbracha.key

8. Copy the pbracha.pem and pbracha.key files to the client.

I found information on how and which files to edit on the router so that new certificates have a longer validity period — available at the link, but in case it stops working, I am also posting a screenshot of the answer:

I wanted to sign a new certificate with the same CA as the current valid certificate. I used the CA.pl tool (a Perl script) available on the router. Unfortunately, an error was returned along with the serial number of the current certificate, which prevented the new certificate from being signed. On impulse, I deleted the existing certificate without revoking it first. This is where the problem arose. Fortunately, even without the physical certificate file, it can be revoked. Openssl on EdgeRouter keeps all copies of signed certificates in the path /usr/lib/ssl/misc/demoCA/newcerts/. We can obtain serial from the file /usr/lib/ssl/misc/demoCA/index.txt. For example for CN=pbracha — output — proper serial is in 4th column:

grep -F "/CN=pbracha" /usr/lib/ssl/misc/demoCA/index.txt | cut -f4

If we would have a few lines for the same CN (for example old and new ones) we are able to show all of them with status and date:

grep -F "/CN=pbracha" /usr/lib/ssl/misc/demoCA/index.txt | awk -F'\t' '{print "STATUS="$1, "EXP="$2, "SERIAL="$4, "SUBJ="$6}'

With the serial number, we can use it for the following command:

openssl ca -revoke /usr/lib/ssl/misc/demoCA/newcerts/HERE_PUT_OBTAINED_SERIAL.pem -keyfile /config/auth/cakey.pem -cert /config/auth/cacert.pem

If, after upgrading the system, the /usr/lib/ssl/misc/demoCA directory has been deleted from the router, a copy of it can be found in the path /root.dev/w.o/usr/lib/ssl/misc. Simply copy it and the problem with signing certificates should be solved. The expiration dates of the certificates are also replaced.

Procedure for renewing the cacert.pem file (this method will work for any certificate that has not yet expired):

1. I generated a new cacert_new.pem certificate signed with the existing cakey.pem key, which was created together with the cacert.pem file:

cd /usr/lib/ssl/misc
openssl x509 -in /config/auth/cacert.pem \
  -signkey /config/auth/cakey.pem \
  -days 3650 -sha256 \
  -set_serial 0x$(openssl rand -hex 16) \
  -out cacert_new.pem

2. I verified that one of the already issued certificates is correctly validated by the cacert_new.pem certificate:

openssl verify -CAfile cacert_new.pem /config/auth/pbracha.pem

3. Result of the above command:

/config/auth/pbracha.pem: OK

4. All that remains is to send to all users a new file → cacert_new.pem (first rename it to cacert.pem so that users do not have to change anything on their devices). Also move it to /config/auth on the router and make a copy the existing cacert.pem.

If the error Use of uninitialized value $1 in concatenation (.) or string at ./CA.pl line 133 appears when running the CA.pl script, a correction must be made in the CA.pl script:

1. Edit this file using vi editor:

vi CA.pl

2. Find line 133:

$RET = run("$REQ -new $1 -keyout $NEWKEY -out $NEWREQ $DAYS $EXTRA{req}");

and comment it out by adding the # symbol at the beginning of the line. Add the following two in its place:

my $nodes_option = defined($1) ? $1 : "";
$RET = run("$REQ -new $nodes_option -keyout $NEWKEY -out $NEWREQ $DAYS $EXTRA{req}");

3. Save the file by typing :wq and try once again CSR generation.