I have a working openvpn server, however I need to add a new client to my pool. The problem is that I do not seem to have the original rsa folder that was created when I was setting it up the first time. Based on what I read it looks like one needs that folder at leasts it sounds that way to me.

Is it possible to add new clients to my OpenVpn pool without the original rsa folder, by just using the existing server keys?

I am on Debian.



You need the private key (possibly cacert.key if you've been following tutorials) of the CA certificate (cacert.crt) that's in the OpenVPN file, so you can issue new certificates signed by that CA certificate.

If you do not have this private key (typically a .key or .pem file) then you cannot issue any more client certificates, nor can you issue revocation lists. You'll need to create a new CA and new server and client certificates signed by it in that case.

Your only other option is to modify the server configuration to accept passwords in addition to certificates, which is less secure than just accepting certificates.

| improve this answer | |
  • I have ca.crt, dh2048.pem, server.crt, server.key, ta.key – yarun can Jan 19 '14 at 4:27
  • If you don't have ca.key, or the key isn't in ca.crt (look in the file for anything about "RSA PRIVATE KEY" or similar), you're out of luck. – LawrenceC Jan 19 '14 at 4:31
  • I will dig into my backups to see if I have the ca.ckey somewhere. How do I issue a new client if I have the "ca.key" in this situation? – yarun can Jan 19 '14 at 4:33
  • openvpn.net/index.php/open-source/documentation/howto.html - then Ctrl+F for "Generate certificate & key for server" - if you have all your files in the right place you can just run the build-key command again (don't run any of the commands before). Typically though I use xca (xca.sourceforge.net) to create and manage certs. – LawrenceC Jan 19 '14 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.