|
| 1 | +--- |
| 2 | +title: 'Generate and export certificates for point-to-site: Linux - OpenSSL' |
| 3 | +description: Learn how to create a self-signed root certificate, export the public key, and generate client certificates using OpenSSL. |
| 4 | +titleSuffix: Azure VPN Gateway |
| 5 | +author: cherylmc |
| 6 | +ms.service: vpn-gateway |
| 7 | +ms.topic: how-to |
| 8 | +ms.date: 03/25/2024 |
| 9 | +ms.author: cherylmc |
| 10 | + |
| 11 | +--- |
| 12 | +# Generate and export certificates - Linux - OpenSSL |
| 13 | + |
| 14 | +VPN Gateway point-to-site (P2S) connections can be configured to use certificate authentication. The root certificate public key is uploaded to Azure and each VPN client must have the appropriate certificate files installed locally in order to connect. This article helps you create a self-signed root certificate and generate client certificates using OpenSSL. For more information, see [Point-to-site configuration - certificate authentication](vpn-gateway-howto-point-to-site-resource-manager-portal.md). |
| 15 | + |
| 16 | +## Prerequisites |
| 17 | + |
| 18 | +To use this article, you must have a computer running OpenSSL. |
| 19 | + |
| 20 | +## Self-signed root certificate |
| 21 | + |
| 22 | +This section helps you generate a self-signed root certificate. After you generate the certificate, you export root certificate public key data file. |
| 23 | + |
| 24 | +1. The following example helps you generate the self-signed root certificate. |
| 25 | + |
| 26 | + ```CLI |
| 27 | + openssl genrsa -out caKey.pem 2048 |
| 28 | + openssl req -x509 -new -nodes -key caKey.pem -subj "/CN=VPN CA" -days 3650 -out caCert.pem |
| 29 | + ``` |
| 30 | + |
| 31 | +1. Print the self-signed root certificate public data in base64 format. This is the format that's supported by Azure. Upload this certificate to Azure as part of your [P2S configuration](vpn-gateway-howto-point-to-site-resource-manager-portal.md#uploadfile) steps. |
| 32 | + |
| 33 | + ```CLI |
| 34 | + openssl x509 -in caCert.pem -outform der | base64 -w0 && echo |
| 35 | + ``` |
| 36 | + |
| 37 | +## Client certificates |
| 38 | + |
| 39 | +In this section, you generate the user certificate (client certificate). Certificate files are generated in the local directory in which you run the commands. You can use the same client certificate on each client computer, or generate certificates that are specific to each client. It's crucial is that the client certificate is signed by the root certificate. |
| 40 | + |
| 41 | +1. To generate a client certificate, use the following examples. |
| 42 | + |
| 43 | + ```CLI |
| 44 | + export PASSWORD="password" |
| 45 | + export USERNAME=$(hostnamectl --static) |
| 46 | + |
| 47 | + # Generate a private key |
| 48 | + openssl genrsa -out "${USERNAME}Key.pem" 2048 |
| 49 | + |
| 50 | + # Generate a CSR (Certificate Sign Request) |
| 51 | + openssl req -new -key "${USERNAME}Key.pem" -out "${USERNAME}Req.pem" -subj "/CN=${USERNAME}" |
| 52 | + |
| 53 | + # Sign the CSR using the CA certificate and CA key |
| 54 | + openssl x509 -req -days 365 -in "${USERNAME}Req.pem" -CA caCert.pem -CAkey caKey.pem -CAcreateserial -out "${USERNAME}Cert.pem" -extfile <(echo -e "subjectAltName=DNS:${USERNAME}\nextendedKeyUsage=clientAuth") |
| 55 | + ``` |
| 56 | + |
| 57 | +1. To verify the client certificate, use the following example. |
| 58 | + |
| 59 | + ```CLI |
| 60 | + openssl verify -CAfile caCert.pem caCert.pem "${USERNAME}Cert.pem" |
| 61 | + ``` |
| 62 | + |
| 63 | +## To use this client certificate on another Linux computer |
| 64 | + |
| 65 | +Each client computer requires two files in order to authenticate: |
| 66 | + |
| 67 | +* The file that contains the client key: caKey.pem |
| 68 | +* The file that contains the certificate public data: caCert.pem |
| 69 | + |
| 70 | +Copy both of these files and transfer them to the Linux client computer. |
| 71 | + |
| 72 | +## Next steps |
| 73 | + |
| 74 | +To continue configuration steps, see [Point-to-site certificate authentication](vpn-gateway-howto-point-to-site-resource-manager-portal.md#uploadfile). |
0 commit comments