Nice article here about safer key usage: Generate your new sexy Ed25519 key (EdDSA using Twisted Edward curves) and a robust RSA key (Rivest\u2013Shamir\u2013Adleman).<\/p>\n Add these to the SSH agent via ssh-add:<\/p>\n Important reading: https:\/\/community.openvpn.net\/openvpn\/wiki\/Concepts-Authentication<\/a><\/p>\n There is a good tool that helps you create your key pairs and certificates for\u00a0OpenVPN with Client Certificates called easy-rsa<\/em>. But it does rely on the fact that you are your own Certificate Authority.<\/p>\n We want to use CA-Cert<\/a>\u00a0to sign our certificates, so we must make a Certificate Signing Request<\/p>\n Note that OpenSSL and OpenSSH use different formats for there keys. OpenSSH uses a propriety format PKCS#1 PEM-encoded for its private key, OpenSSL uses a standard format IIUC.<\/p>\n For OpenVPN (SSL) we use the OpenSSL toolset to generate the certificates. OpenSSL command line cannot create\u00a0Ed25519 keys (not yet, anyway).<\/p>\n Some interesting readings on OpenSSL: Generate the CSR, fill in the details as required. You could leave everything empty if the certificate will only be used by OpenVPN. As your email address is not in the certificate, the certificate cannot be used to track you.<\/p>\n Send this to\u00a0CA-Cert<\/a>, and receive a signed certificate from them by email.<\/p>\n Information from certificates and CSRs can be obtained with this:<\/p>\n The big question that now pops-up is if we trust\u00a0CA-Cert<\/a> enough to let them sign the certificates. If we would be our own Certificate Authority, we would know exactly which certificates we have signed.<\/p>\n If you are using OpenVPN for your organisation it is probably better not to use any public certificates for OpenVPN but create your own CA and only accept certificates issued by this CA. This is actually the way proposed in the\u00a0OpenVPN Howto<\/a>. This way you are in full control of the certificates and even if some of the public CA’s gets compromised and issues certificates in your name then none of your OpenVPN endpoints will accept these, because only certificates issued by your own CA gets accepted.<\/p>\n Apart from that: Using a self-signed certificate does not impose a risk by itself, not for VPN and not for HTTPS. The risk is only if the certificate is not fully validated. A self-signed certificate can not be validated without additional information. So if a client connects to a server,\u00a0the connection is\u00a0 encrypted, but the server is not verified.<\/p>\n If the server is not verified a man in the middle attack is possible. This not only includes stealing the VPN credentials but intercepting the traffic or modifying the traffic. Since VPN connections are often considered as safe as internal connections inside the company the attacker can thus get access to interesting data or mount attacks against internal clients.<\/p>\n Knowing this, we will need to add some extra security measures.<\/p>\n Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.<\/p>\n If you get the error:<\/p>\n It means the openssl configuration file ( normally at \u200b\/etc\/ssl\/openssl.cnf<\/em>) is missing this extension. So add it:<\/p>\n Generate the DH parameters<\/p>\n If you want to harden the security, you could have a look at the openVPN server options:<\/p>\n <\/p>\n openssl x509 -noout -subject -in<\/p>\n Convert one to another with:<\/p>\n openssl pkcs8 -topk8 -in <server.key> -out server-pkcs8.key \u2013nocrypt<\/p>\n <\/p>\n ssh-keygen -o -a 100 -t ed25519 -f <username>.key<\/p>\n openssl req\u00a0-key <username>.key -new -out <username>.csr<\/p>\n <\/p>\n sssh-keygen -f <input>.key -e -m pem<\/p>\n But these are SSH k<\/p>\n <\/p>\n openssl genrsa -des3 -out private.pem 4096<\/p>\n openssl genpkey -algorithm Ed25519 -out ed25519key.pem<\/p>\n openssl req -new -sha256 -key za -out za.csr<\/p>\n \/usr\/syno\/etc\/packages\/VPNCenter\/openvpn<\/p>\n <\/p>\n \/opt\/share\/easy-rsa#<\/p>\n \/var\/packages\/VPNCenter\/target\/scripts\/openvpn.sh {start|stop|restart}<\/p>\n Now, we need to build a router key\/certificate pair:<\/p>\n <\/p>\n Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Crypto-systems and keys Nice article here about safer key usage: https:\/\/blog.g3rt.nl\/upgrade-your-ssh-keys.html Generate your new sexy Ed25519 key (EdDSA using Twisted Edward curves) and a robust RSA key (Rivest\u2013Shamir\u2013Adleman). ssh-keygen -o -a 100 -t ed25519 ssh-keygen -t rsa -b 4096 -o -a 100 Add these to the SSH agent via ssh-add: \u00a0ssh-add OpenVPN Important reading: https:\/\/blog.g3rt.nl\/openvpn-security-tips.html … Continue reading “Certificates, keys, SSL and Openvpn on Synology”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-83","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/posts\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=83"}],"version-history":[{"count":14,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions"}],"predecessor-version":[{"id":97,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions\/97"}],"wp:attachment":[{"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/wordpress.joontech.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nhttps:\/\/blog.g3rt.nl\/upgrade-your-ssh-keys.html<\/a><\/p>\nssh-keygen -o -a 100 -t ed25519\r\nssh-keygen -t rsa -b 4096 -o -a 100<\/pre>\n
\u00a0ssh-add<\/pre>\n
OpenVPN<\/h1>\n
\nhttps:\/\/blog.g3rt.nl\/openvpn-security-tips.html<\/a><\/p>\n
\nI could not find how to convert the private OpenSSH key to a OpenSSL format. So we will regenerate the keys with OpenSSL. (PEM format)<\/p>\nopenssl genpkey -algorithm RSA \\\r\n -pkeyopt rsa_keygen_bits:4096\\\r\n -pkeyopt rsa_keygen_pubexp:65537 | \\\r\n openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-private-key.pem\r\n\r\nopenssl pkey -pubout -inform pem -outform pem \\\r\n -in rsa-4096-private-key.pem \\\r\n -out rsa-4096-private-key.spki<\/pre>\n
\nhttps:\/\/www.sslshopper.com\/article-most-common-openssl-commands.html<\/a><\/p>\nopenssl req -new -sha256 -key rsa-4096-private-key.pem -out rsa-4096-private-key.csr<\/pre>\n
openssl x509 -noout -subject -in\u00a0<certificate>.crt\r\nopenssl req -in <request>.csr -noout -text<\/pre>\n
\n
\nhttps:\/\/github.com\/OpenVPN\/openvpn\/blob\/master\/sample\/sample-scripts\/ucn.pl
\n<\/a>Unfortunatly, CaCert does not put the CN in their certificates if you are not a “Trusted User (WoT)”.<\/li>\n<\/ul>\nopenssl genpkey -algorithm RSA \\\r\n -pkeyopt rsa_keygen_bits:4096\\\r\n -pkeyopt rsa_keygen_pubexp:65537 | \\\r\n openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem\r\n\r\nopenssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr<\/pre>\n
openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr \r\nError Loading extension section server<\/pre>\n
[ server ]\r\n# comment that this section was added manually by myself \r\nnsCertType = server<\/pre>\n
openssl dhparam 2048 > dh2048.pem<\/pre>\n
username-as-common-name\r\nclient-config-dir <dir><\/pre>\n
.\/build-key-server server1<\/code><\/p>\nopenssl genpkey -algorithm RSA \\\r\n -pkeyopt rsa_keygen_bits:4096\\\r\n -pkeyopt rsa_keygen_pubexp:65537 | \\\r\n openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem\r\n\r\nopenssl pkey -pubout -inform pem -outform pem \\\r\n -in rsa-4096-server-key.pem \\\r\n -out rsa-4096-server-key.spki\r\n\r\nopenssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr<\/pre>\n