---
title: 'Tutorial: Configure External PKI with SecureW2'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--epki-with-securew2/
product: Access Server Docs
description: How to set up the Access Server External PKI (Public Key Infrastructure) feature using SecureW2.
---

# Tutorial: Configure External PKI with SecureW2

## Overview

The Access Server external public key infrastructure (PKI) feature integrates Access Server with third-party tools for X509 PKI management instead of using the built-in certificate management capabilities.

When configured for external PKI usage, Access Server doesn't manage client certificates directly; instead, the customer's third-party PKI software generates and distributes client certificate/key pairs to client machines and a server certificate/key pair to the OpenVPN server.

This tutorial shows you how to set up external PKI using SecureW2.

At a high level, these are the steps for your configuration:

1. Modify **as.conf** to set Access Server in external PKI mode.
2. Create the server and intermediate using SecureW2
3. Create certificate templates for the server and clients via SecureW2.
4. Generate the server certificate and key via SecureW2.
5. Generate the client certificate and key via SecureW2.
6. Create the **TLS\_auth** key.
7. Generate Diffie-Hellman parameters.
8. Import the necessary certificate and key files to Access Server.
9. Provide certificate/key pairs in a P12/PFX file to the VPN client.
10. Generate and download a server-locked profile for the client.

## Prerequisites

- An installed Access Server.
- A SecureW2 account and access to the Management Portal.
- Console access and the ability to get root access.
- An OpenVPN client that supports the macOS Keychain and Windows certificate store.

## Step 1: Set Access Server to external PKI mode.

1. Connect to the Access Server console and get root privileges.
2. Edit **as.conf** for external PKI usage:

   ```
   nano /usr/local/openvpn_as/etc/as.conf
   ```
3. Comment out **certs\_db**:

   ```
   # certificates database
   # certs_db=sqlite:///~/db/certs.db
   ```
4. Save and exit the file — Ctrl-X, Y, then Enter.
   - Access Server no longer uses the certificate database. Instead, an external system must handle this.

## Step 2: Create a server CA

To add a Root CA, follow these next steps:

1. Sign in to the **JoinNow Management Portal**.
2. Go to **Dynamic PKI \> Certificate Authorities**.
3. Click **Add Certificate Authority**.
4. Under **Basic:**
   - From **Generate CA For**, select **Device and User Authentication**.
   - From **Type**, select **Root CA**.
   - In **Common Name**, enter the name for the root CA (for example, **OpenVPN Root CA**).
   - From **Key Size**, select **2048**.
   - From **Signature Algorithm**, select **SHA-256**.
   - In **Validity Period (years)**, enter how long the root CA certificate should remain valid.
5. Click **Save**.

## Step 3: Create an intermediate CA

1. Sign in to the **JoinNow Management Portal**.
2. Go to **Dynamic PKI \> Certificate Authorities**.
3. Click **Add Certificate Authority**.
4. Under **Basic:**
   - From **Generate CA For**, select **Device and User Authentication**.
   - From **Type**, select **Intermediate CA**.
   - From **Certificate Authority**, select either an internal or an external CA.
   - In **Common Name**, enter the name for the intermediate CA (for example, **OpenVPN Intermediate CA**).
   - From **Key Size**, select **2048**.
   - From **Signature Algorithm**, select **SHA-256**.
   - In **Validity Period (years)**, enter how long the Intermediate CA should remain valid.
5. Under **Notifications:**
   - From **Expiry Notification Frequency (days)**, select how often certificate expiry notifications are sent.
   - Select **Notify user on successful Enrollment** to send a notification after successful enrollment.
6. Under **Revocation:**
   - In **Revoke Certificate if unused for**, enter the number of days after which an unused certificate is revoked, and choose one of:
     - **Since last usage** — revoke if the certificate remains unused for that number of days.
     - **Since certificate issuance** — revoke that number of days after issuance.
   - From **Reason Code**, select a revocation reason: **Certificate Hold**, **AA Compromise**, **Privilege Withdrawn**, or **Unspecified**.
7. Click **Save**.

## Step 4: Create a server template

1. Go to **Dynamic PKI \> Certificate Authorities**.
2. In the **Certificate Templates** section, click **Add Certificate Template**.
3. Under **Basic:**
   - In **Name**, enter a name for the server template (for example, **OpenVPN Server Template**).
   - In **Validity Period**, enter the validity duration in **d m y** format (for example, `0d 0m 1y` for one year).
4. Under **Extended Key Usage**, from **Use Certificate For**, select **Server Authentication**.
5. Click **Save**.

## Step 5: Create a client template

1. Go to **Dynamic PKI \> Certificate Authorities**.
2. In the **Certificate Templates** section, click **Add Certificate Template**.
3. Under **Basic:**
   - In **Name**, enter a name for the server template (for example, **OpenVPN Client Template**).
   - In **Validity Period**, enter the validity duration in **d m y** format (for example, `0d 0m 1y` for one year).
4. (Optional, for deployments using auto-login profiles.) Under **Certificate Extensions**, in **SAN \> Other Name**, replace the text in the box with `autologinrole`.
5. Under **Extended Key Usage**, from **Use Certificate For**, select **Client Authentication**.
6. Click **Save**.

## Step 6: Create a server certificate and key

1. Go to **Dynamic PKI \> Create Certificate**.
2. Under **Device Info**, from **Operating System**, select **Linux**.
3. Under **Certificate Signing Request**:
   - Select **Generate Keypair and CSR**.
   - In **Subject**, enter the common name for the server certificate (for example, **CN=server**).
4. Under **Certificate Issuance Policy:**
   - From **Certificate Authority**, select the intermediate CA you created earlier.
   - From **Use Certificate Template**, select the server template you created earlier.
   - Select **Include Entire Certificate Chain**.
5. Under **Distribution \> Format**, select **PEM**.
   - From **Format**, select **PEM**.
   - From **Receive via**, select **Download**.
6. Click **Create**.
   - When prompted, create a password for the server's private key.
7. A ZIP file downloads containing:
   - Server Certificate (**server.crt**)
   - Server Key (**server.key**)
   - CA Bundle (**cacert.crt**)

## Step 7: Create a client certificate and key

1. Go to **Dynamic PKI \> Create Certificate**.
2. Under **Device Info**, from **Operating System**, select the VPN user's operating system (for example, Windows or macOS).
3. Under **Certificate Signing Request:**
   - Select **Generate keypair and CSR**.
   - In **Subject**, enter the common name for the client certificate (for example, **CN=etest**).
4. Under **Certificate Issuance Policy:**
   - From **Certificate Authority**, select the intermediate CA you created earlier.
   - From **Use Certificate Template**, select the client template you created earlier.
5. Under **Distribution:**
   - From **Format**, select **PKCS12**.
   - From **Receive via**, select **Download**.
6. Click **Create**.
   - When prompted, create a password for the client's private key.
7. A `.p12` file is generated (for example, `etest.p12`.

## Step 8: Configure the necessary files on Access Server

1. Connect to the Access Server console and get root privileges.
2. Create a directory:

   ```
   mkdir epki && cd epki
   ```
3. Place the CA bundle, server certificate, and key generated from SecureW2 via WinSCP or SCP in this new "epki" directory.
4. Remove the password from the server key:

   ```
   openssl rsa -in server.key -out newserver.key
   ```

   > **Important**
   >
   > When running this command, you'll be prompted for a password. Use the password you configured for the server key file earlier.
5. Create a **tls\_auth** key for the OpenVPN server:

   ```
   /usr/local/openvpn_as/scripts/certool --tls_auth
   ```
6. Generate Diffie Hellman parameters for the OpenVPN server:

   ```
   openssl dhparam -out dh.pem 2048
   ```
7. Generate your auth token and add the generated file:

   ```
   /usr/local/openvpn_as/scripts/certool --auth_token
   ```
8. Configure X509 explicit/extended key usage based on RFC3280 TLS rules:

   ```
   /usr/local/openvpn_as/scripts/sacli --key "external_pki.remote_cert_usage" --value eku ConfigPut
   ```
9. Configure the use of the X509 “subjectAtlName” attribute for the declaration of auto-login permission:

   ```
   /usr/local/openvpn_as/scripts/sacli --key "external_pki.autologin_x509_spec" --value "subjectAltName,,autologinrole" ConfigPut
   ```
10. Generate the tls-crypt-v2 key:

    ```
    /usr/local/openvpn_as/scripts/certool --tls_crypt2_server
    ```
11. Load the newly generated files into the Access Server config database:

    ```
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.ta_key" --value_file ta.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.ca_crt" --value_file cacert.crt ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.server_crt" --value_file server.crt ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.server_key" --value_file newserver.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.dh_pem" --value_file dh.pem ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.auth_token_key" --value_file auth_token.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.tls_cryptv2_server" --value_file tls_crypt2.key ConfigPut
    ```
12. Start Access Server:

    ```
    systemctl restart openvpnas
    ```

## Step 9: Configure a test client

To test our example, we generate a test client, **etest**.

1. Sign in to the Admin Web UI.
2. Click **Users**.
3. Click **Add New User**.
4. Create the new user, **etest**, and click **Save**.
5. (Optional, for environments using auto-login profiles.) Under **Permissions**, set **Allow Auto-login** to **Enabled**, then **Save**.
6. Click **Reset Password**.
7. Enter a password and click **Reset**.
8. Click **Restart**.
9. Finally, generate a server-locked profile. The profile will be stored in **etest.ovpn**:

   ```
   sacli GetGeneric >etest.ovpn
   ```

   For generating an auto-login profile:

   ```
   sacli --user etest GetAutologin >etest.ovpn
   ```
10. Copy these two files to the client machine:
    - Client P12 file (etest.p12)
    - Client profile (etest.ovpn)

## Step 10: Import the client profile and the client P12 file into OpenVPN Connect v3

1. Launch OpenVPN Connect v3.
2. Import the connection profile, **etest.ovpn**.
3. Select **Menu → Certificate & Tokens**.
4. Under **PKCS#12**, Select the **Add** icon.
5. Select your client P12 file (etest.p12).
6. Enter the password for this file that you previously configured, then select **OK**.
7. Go back to the **Home**.
8. Select **Menu → My Profiles**.
9. Select the **Edit** icon for the profile.
10. Under **Certificates**, use the **Select** button to add the external certificate to the profile.
11. Select the P12 file.
12. Select **Save Changes**.
13. Select **Connect** to start the profile's connection.

## Simplified ePKI client configuration (Access Server 2.14.2 and later)

With the release of Access Server 2.14.2, we've made configuring client connection profiles for ePKI easier. Previously, creating these profiles required using the command line, as noted in the tutorial. However, in version 2.14.2 and later, you can now create and manage ePKI client connection profiles directly from Access Server's Client Web UI.

There are two types of ePKI profiles available:

1. **Generic ePKI profile:**
   - This profile requires the user to authenticate with a password when connecting.
   - Ideal for environments where a password-based security layer is needed in addition to certificate-based authentication.
2. **Auto-login ePKI profile;**
   - This profile automatically uses the certificate for authentication without requiring a password.
   - Suitable for unattended devices or systems where automatic, certificate-based login is needed.

In addition, the **Import Profile from URL** functionality in **OpenVPN Connect** allows users to import these connection profiles directly, making the configuration process faster and more seamless.

This update simplifies the ePKI setup, providing more flexibility and reducing the reliance on the command line.

## Certificate Revocation Lists

A Certificate Revocation List (CRL) is a digitally-signed list maintained by a Certificate Authority (CA). It contains the serial numbers of certificates revoked before their scheduled expiration date. CRLs are a critical security mechanism in any PKI deployment, allowing administrators to immediately invalidate compromised or untrusted certificates.

In Access Server, CRLs ensure that VPN clients using revoked certificates can't authenticate. Even certificates that are otherwise valid can be immediately blocked when security circumstances change.

### Configuration and usage

- A CRL allows administrators to deny access to specific client certificate serial numbers.
- If a client attempts to connect using a certificate listed in the CRL, access is denied.
- Any client already connected whose certificate appears in the CRL at the time it's loaded is immediately disconnected.
- The CRL field is specified via the `vpn.server.crl` key and initially loaded using:

  ```
  sacli start
  ```
- Once loaded, the CRL file may be updated at any time. The Access Server automatically reloads it within a few seconds.
- Reload timing is controlled by the `vpn.server.crl_resample` key (integer, in seconds, default = 10).
- The CRL file must be in **PEM format**.

### Add a CRL to Access Server

Follow these steps to retrieve and enable a CRL in ePKI mode.

#### 1. Obtain the CRL from SecureW2

1. Sign in to the **JoinNow Management Portal**.
2. Go to **Dynamic PKI \> Certificate Authorities**.
3. Select your **Intermediate CA**.
4. Click the **view** icon under **Functions**.
5. Under **CRL \> Base**, copy the CRL URL.
   - Example: `http://crl.securew2.com/crl/abcde12345/OpenVPN Intermediate CA.crl`

   > **Note**
   >
   > SecureW2's Base CRL updates on a default one-week interval. This means newly revoked certificates aren't reflected in the CRL until the next update cycle completes.
   >
   > If your deployment requires more frequent updates, such as immediate revocation enforcement, contact SecureW2 Support to request a shorter CRL update interval.

#### 2. Download and load the CRL

1. Connect to your Access Server console and get root privileges.
2. Download the CRL and save it in PEM format:

   ```
   wget http://crl.securew2.com/crl/abcde12345/'OpenVPN Intermediate CA.crl' -O /root/crl.pem
   ```
3. Load the CRL into Access Server:

   ```
   sacli --key "vpn.server.crl" --value "/root/crl.pem" ConfigPut
   sacli start
   ```

#### 3. Confirm CRL enforcement

Once the CRL is active:

- Any client connecting with a revoked certificate is denied access.
- Any already-connected client whose certificate appears in the CRL is disconnected automatically.
- Future CRL updates are detected and applied automatically according to the resample interval (`vpn.server.crl_resample`).

---

Prev: [Tutorial: Configure External PKI with Microsoft Active Directory Certificate Services (AD CS)](https://openvpn.net/as-docs/v3/tutorials/tutorial--epki-with-microsoft-ad-cs.md)
Next: [Tutorial: Configure External PKI with Futurex CryptoHub for Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--epki-with-futurex-cryptohub.md)
Index: https://openvpn.net/as-docs/llms.txt