root@Gargoyle:~$ build-key-pass user
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/easy-rsa/keys
Generating a 1024 bit RSA private key
.........++++++
.............++++++
writing new private key to 'user.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [PL]:
State or Province Name (full name) [SL]:
Locality Name (eg, city) [Gliwice]:
Organization Name (eg, company) [Chata]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [user]:
Name []:
Email Address [router@chata.dom]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'PL'
stateOrProvinceName   :PRINTABLE:'SL'
localityName          :PRINTABLE:'Gliwice'
organizationName      :PRINTABLE:'Chata'
commonName            :PRINTABLE:'user'
emailAddress          :IA5STRING:'router@chata.dom'
Certificate is to be certified until Apr  9 20:48:16 2022 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2

Apr 11 22:25:57 Gargoyle authpriv.notice dropbear[6873]: Password auth succeeded for 'root' from 192.168.1.238:52361
Apr 11 22:27:01 Gargoyle cron.err crond[2450]: USER root pid 6879 cmd /bin/3gtester
Apr 11 22:30:01 Gargoyle cron.err crond[2450]: USER root pid 6913 cmd /bin/3gtester
Apr 11 22:31:01 Gargoyle cron.err crond[2450]: USER root pid 6921 cmd /usr/bin/set_kernel_timezone >/dev/null 2>&1
Apr 11 22:33:01 Gargoyle cron.err crond[2450]: USER root pid 6936 cmd /bin/3gtester
Apr 11 22:36:01 Gargoyle cron.err crond[2450]: USER root pid 6972 cmd /bin/3gtester
Apr 11 22:39:01 Gargoyle cron.err crond[2450]: USER root pid 6991 cmd /bin/3gtester
Apr 11 22:41:01 Gargoyle cron.err crond[2450]: USER root pid 6995 cmd /usr/bin/set_kernel_timezone >/dev/null 2>&1
Apr 11 22:42:01 Gargoyle cron.err crond[2450]: USER root pid 7004 cmd /bin/3gtester
Apr 11 22:45:01 Gargoyle cron.err crond[2450]: USER root pid 7034 cmd /bin/3gtester
Apr 11 22:48:01 Gargoyle cron.err crond[2450]: USER root pid 7077 cmd /bin/3gtester

root@Gargoyle:~$ cat /etc/easy-rsa/vars
# easy-rsa parameter settings

# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.

# This variable should point to
# the top level of the easy-rsa
# tree.
export EASY_RSA="/etc/easy-rsa"

#
# This variable should point to
# the requested executables
#
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"


# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA`

# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR="$EASY_RSA/keys"

# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR

# PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"

# Increase this to 2048 if you
# are paranoid.  This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=1024

# In how many days should the root CA key expire?
export CA_EXPIRE=3650

# In how many days should certificates expire?
export KEY_EXPIRE=3650

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="PL"
export KEY_PROVINCE="SL"
export KEY_CITY="Gliwice"
export KEY_ORG="Chata"
export KEY_EMAIL="router@chata.dom"

root@Gargoyle:~$ clean-all
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/easy-rsa/keys
root@Gargoyle:~$ build-ca
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/easy-rsa/keys
Generating a 1024 bit RSA private key
...................++++++
...............................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [PL]:
State or Province Name (full name) [SL]:
Locality Name (eg, city) [Gliwice]:
Organization Name (eg, company) [Chata]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [Chata CA]:
Name []:
Email Address [router@chata.dom]:
root@Gargoyle:~$
root@Gargoyle:~$
root@Gargoyle:~$ ls /etc/easy-rsa/
keys         openssl.cnf  vars

root@Gargoyle:~$ build-key-pass user
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/easy-rsa/keys
Generating a 1024 bit RSA private key
.++++++
...++++++
writing new private key to 'user.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [PL]:
State or Province Name (full name) [SL]:
Locality Name (eg, city) [Gliwice]:
Organization Name (eg, company) [Chata]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [user]:
Name []:
Email Address [router@chata.dom]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'PL'
stateOrProvinceName   :PRINTABLE:'SL'
localityName          :PRINTABLE:'Gliwice'
organizationName      :PRINTABLE:'Chata'
commonName            :PRINTABLE:'user'
emailAddress          :IA5STRING:'router@chata.dom'
Certificate is to be certified until Apr  9 21:52:00 2022 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated