VPN Certs seems to be expired

openBalena
10

Hi @dtischler,
thank you for the input. That put me on the right track. I think, to renew all certs with the quickstart script possible create a new root ca. But I only need a new server cert. But maybe your are right and this way works as well.

I choose a different way and manually create a new server certificat with following steps.

  1. Renamed the following old files in the config/certs/vpn folder.
  • issued/vpn.balena.iet.mw.tu-dresden.crt
  • private/vpn.balena.iet.mw.tu-dresden.key
  • reqs/vpn.balena.iet.mw.tu-dresden.req
  • index.txt
  1. Download easy-rsa to a temporary folder and extract it with following command:

curl -sL https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz | tar xz --strip-components=1

  1. Recreate the servcer certificat with key with this command:

./easyrsa/easyrsa --pki-dir="./vpn" --days=730 build-server-full "vpn.<server-domain>" nopass

  1. Convert with this command the cert- and the key-file to an base64 string and replace the values of the keys OPENBALENA_VPN_SERVER_CRT and OPENBALENA_VPN_SERVER_KEY.
  • echo "$(cat ./vpn/issued/vpn.<server-domain>.crt)" | base64 --wrap=0 2>/dev/null
  • echo "$(cat ./vpn/private/vpn.<server-domain>.key)" | base64 --wrap=0 2>/dev/null
  1. Recreate the VPN Container.

./scripts/compose up -d --force-recreate --no-deps

This steps worked for me and the client connect after a short time and marked as online in the device list.

5 Likes