3

i have an existing ca key and cert. how do i tell easyrsa to use that to generate server and client certs, instead of generating its own? All the docs seem to mention to do an init-pki to initialize a fresh PKI for it.

Improve this question

1 Answer 1

Reset to default
3

If you read the docs here you should see the files that are created by Easy RSA. If you overwrite the private key and ca certificate, you should be able to replace the internally generated ones with your own.

The files are pki/ca.crt for the CA certificate and pki/private/ca.key for the private key.

Improve this answer
2
  • what about the ‘serial’ file
    – pdeva
    Nov 23, 2020 at 12:57
  • The serial file is the serial number of the certificates issued by the CA. While you can change it and the CA will still issue certificates, you should be aware of the definition of the serial number field from RFC 5280: The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate). So as long as the CA certificate doesn't issue the same serial then you can set it to whatever you want.
    – garethTheRed
    Nov 23, 2020 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .