一.修改安装源并安装easy-rsa
mkdir /etc/yum.repos.d/backup; mv /etc/yum.repos.d/*.* /etc/yum.repos.d/backup/
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum install -y easy-rsa
二.配置服务器端证书
cp -r /usr/share/easy-rsa/3.0.7/ /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa/
find / -type f -name "vars.example" | xargs -i cp {} . && mv vars.example vars
./easyrsa init-pki # 创建空的pki
./easyrsa build-ca nopass #创建新的CA，不使用密码
./easyrsa gen-req server nopass #创建服务端证书
./easyrsa sign server server #签约服务端证书
./easyrsa gen-dh #创建Diffie-Hellman
三.用户端证书管理
#新建客户证书
echo "user01"|./easyrsa gen-req user01 nopass
echo "yes"|./easyrsa sign client user01
#吊销证书
echo "yes"|./easyrsa revoke user01
./easyrsa gen-crl
四.要用的证书
服务端
ll /etc/openvpn/easy-rsa/pki/dh.pem
ll /etc/openvpn/easy-rsa/pki/ca.crt
ll /etc/openvpn/easy-rsa/pki/issued/server.crt /etc/openvpn/easy-rsa/pki/private/server.key
用户端
ll /etc/openvpn/easy-rsa/pki/ca.crt
ll /etc/openvpn/easy-rsa/pki/issued/user01.crt
ll /etc/openvpn//easy-rsa/pki/private/user01.key
