1. Stáhnout Easy-RSA (odkaz).
2. Zkopírovat soubor vars.example do souboru vars a upravit.
   1. Volitelně eliptické křivky:
      1. set_var EASYRSA_ALGO ec
      2. set_var EASYRSA_CURVE secp384r1

# ./easyrsa init-pki
# ./easyrsa build-ca nopass
# ./easyrsa build-server-full <nazevserveru> nopass
# ./easyrsa build-client-full <jmenoklienta> nopass
# ./easyrsa gen-dh

1. server:
   1. pki/ca.crt
   2. pki/private/<nazevserveru>.key
   3. pki/issued/<nazevserveru>.crt
   4. pki/dh.pem
2. klient:
   1. pki/ca.crt
   2. pki/private/<jmenoklienta>.key
   3. pki/issued/<jmenoklienta>.crt

openvpn --genkey secret ta.key

server 172.17.255.0 255.255.255.0
port 1194
proto udp

topology subnet

dev tun

user nobody
group nogroup

persist-key
persist-tun

remote-cert-tls client
cipher AES-256-GCM

#client-to-client
#push "route 192.168.X.0 255.255.255.0 172.17.Y.Z"

# ifconfig-pool-persist ipp.txt

keepalive 10 120

log /var/log/openvpn/<mujserver>.log
verb 3
mute 10

ca       [inline]
cert     [inline]
key      [inline]
dh       [inline]
tls-auth [inline]
key-direction 0

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<dh>
-----BEGIN DH PARAMETERS-----
...
-----END DH PARAMETERS-----
</dh>  

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

client

dev tun
dev-node tap0 <-- název síťového připojení musí být "tap0"

<connection>
remote <server-hostname> 1194 udp
</connection>
nobind

resolv-retry infinite
persist-key
persist-tun
auth-nocache

remote-cert-tls server
cipher AES-256-GCM

log "..\\log\\<firma>-<username>log"
verb 3
mute 10

ca       [inline]
cert     [inline]
key      [inline]
tls-auth [inline]
key-direction 1

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

grep "^R" /etc/openvpn/<nazevfirmy>/pki/index.txt

./easyrsa revoke <jmenoklienta>
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl

+ přidat do konfiguráku serveru:

crl-verify /etc/openvpn/<nazevfirmy>/pki/crl.pem

Po zneplatnění je potřeba restartovat OpenVPN server:

systemctl restart openvpn@<mujserver>.service