Tutorial: Configure External PKI with Access Server's certool Script⁠

• An installed Access Server.

• An external PKI tool.

• Console access and the ability to get root access.

• An OpenVPN client that supports the macOS Keychain and Windows certificate store.

1. Connect to the Access Server console and get root privileges.

2. Edit as.conf for external PKI usage:

   nano /usr/local/openvpn_as/etc/as.conf

3. Comment out certs_db:

   # certificates database
   # certs_db=sqlite:///~/db/certs.db

4. Save and exit the file — Ctrl-X, Y, then Enter.

   • Access Server no longer uses the certificate database. Instead, an external system must handle this.

1. Initialize the external PKI files in the epki directory, including the CA cert/key:

   cd /usr/local/openvpn_as/scripts
   mkdir -p epki/root

2. Create a root cert for signing intermediate CAs:

   ./certool --dir epki/root --cn "EPKI Root Test" --type ca

3. Create the intermediate CA:

   ./certool --dir epki/root --type intermediate --serial 1 --cn "EPKI Intermediate" --name inter
   cp epki/root/inter.crt epki/ca.crt
   cp epki/root/inter.key epki/ca.key
   cat epki/root/ca.crt epki/ca.crt >epki/cabundle.crt

4. Create a certificate/key pair for the OpenVPN server:

   ./certool --dir epki --type server --serial 1 --cn server

5. Create a tls_auth key for the OpenVPN server:

   ./certool --dir epki --tls_auth

6. Generate Diffie Hellman parameters for the OpenVPN server:

   openssl dhparam -out epki/dh.pem 2048

7. Load the newly generated files into the Access Server config database:

   sacli --key "external_pki.ta_key" --value_file epki/ta.key ConfigPut
   sacli --key "external_pki.ca_crt" --value_file epki/cabundle.crt ConfigPut
   sacli --key "external_pki.server_crt" --value_file epki/server.crt ConfigPut
   sacli --key "external_pki.server_key" --value_file epki/server.key ConfigPut
   sacli --key "external_pki.dh_pem" --value_file epki/dh.pem ConfigPut

8. For Access Server 2.7 and newer, you must also generate your auth token and add the generated file:

   ./certool --dir epki --auth_token
   ./sacli --key "external_pki.auth_token_key" --value_file epki/auth_token.key ConfigPut

9. Configure X509 explicit/extended key usage based on RFC3280 TLS Rules:

   sacli --key "external_pki.remote_cert_usage" --value eku ConfigPut

10. Configure the use of the X509 “role” attribute for the declaration of auto-login permission:

    sacli --key "external_pki.autologin_x509_spec" --value "role,,AUTOLOGIN" ConfigPut

11. Generate the tls-crypt-v2 key (for Access Server 2.9.0 and higher only):

    ./certool --dir epki --tls_crypt2_server
    ./sacli --key "external_pki.tls_cryptv2_server" --value_file epki/tls_crypt2.key ConfigPut

12. Restart Access Server:

    systemctl restart openvpnas

To test our example, we generate a test client, etest.

1. Sign in to the Admin Web UI.

2. Select Users.

3. Select Add New User.

   • The New User modal displays.

4. Enter the new username, "etest," and assign to a group, then select Save.

   • The single user page for "etest" is displayed.

5. Select Restart.

6. From the console, generate a cert/key pair for etest:

   ./certool --dir epki --type client --serial 2 --cn etest --cabundle epki/cabundle.crt --pkcs12

   • The key is encrypted with a password you enter at the prompt, and certool generates the file epki/etest.p12, which contains the cert/key pair.

7. To test auto-login, generate an auto-login cert/key pair for etest:

   ./certool --dir epki --type client --serial 3 --cn etest --name etestauto --cabundle epki/cabundle.crt --pkcs12 role=AUTOLOGIN
   ./sacli --user etest --key prop_autologin --value true UserPropPut

8. Finally, generate a server-locked profile. The profile will be stored in client.ovpn:

   ./sacli GetGeneric >client.ovpn

9. Copy these three files to the client machine:

   epki/etest.p12:	The userlogin cert/key pair for user etest.
   epki/etestauto.p12:	The autologin cert/key pair for user etest.
   client.ovpn:	The server-locked profile for the Access Server.

10. Install the certificate/key pair:

    • Launch OpenVPN Connect v3.

    • Import the connection profile, client.ovpn.

    • Select the Menu icon.

    • Select Certificate & Tokens.

    • Under PKCS#12, select the Add icon.

    • Select your Client P12 File (etest.p12).

    • Enter the password previously configured, then select OK.

    • Select My Profiles and edit the profile.

    • Under Certificates, use the Select button to add the external certificate to the profile.

    • Select the p12 file.

    • Select Save Changes.

    • Select Connect to start the profile connection.

With the release of Access Server 2.14.2, we've made configuring client connection profiles for ePKI easier. Previously, creating these profiles required using the command line, as noted in the tutorial. However, in version 2.14.2 and later, you can now create and manage ePKI client connection profiles directly from Access Server's Client Web UI.

There are two types of ePKI profiles available:

1. Generic ePKI profile:

   

   • This profile requires the user to authenticate with a password when connecting.

   • Ideal for environments where a password-based security layer is needed in addition to certificate-based authentication.

2. Auto-login ePKI profile;

   

   • This profile automatically uses the certificate for authentication without requiring a password.

   • Suitable for unattended devices or systems where automatic, certificate-based login is needed.

In addition, the Import Profile from URL functionality in OpenVPN Connect allows users to import these connection profiles directly, making the configuration process faster and more seamless.

This update simplifies the ePKI setup, providing more flexibility and reducing the reliance on the command line.

Currently, Access Server uses the following client certificate naming conventions:

1. The Common Name of the certificate must match the username of the connecting client.

2. Autologin certificates, which don't require username/password authentication (only client certificate authentication), must be tagged to indicate that they hold this right.

A Certificate Revocation List (CRL) is a digitally-signed list maintained by a Certificate Authority (CA). It contains the serial numbers of certificates revoked before their scheduled expiration date. CRLs are a critical security mechanism in any PKI deployment, allowing administrators to immediately invalidate compromised or untrusted certificates.

In Access Server, CRLs ensure that VPN clients using revoked certificates can't authenticate. Even certificates that are otherwise valid can be immediately blocked when security circumstances change.