cybersecurity
In this article, Cyber Security Analyst Taylor Melvin at TeamCISO conducts a a step by step walk through about the setup and integration of LetsEncrypt with OpenVPN, and how to automate the renewal process.
OpenVPN is an open-source virtual private network software that allows for the creation of secure point-to-point or site-to-site connections. By implementing LetsEncrpyt with OpenVPN, it allows for easy updating of SSL/TLS certificates. Even though LetsEncrpyt certificates expire every 90 days, we can automate the renewing process with cronjobs.
The implementation of LetsEncrypt will be done on the OpenVPN Appliance.
The setup process of the appliance can be found here:
https://teamciso.com/2020/03/teamcisos-integration-of-openvpn-into-work-environment.html
It should be noted that vpn.server.com it needs to be replaced with your domain name (vpn.DOMAIN.com). Wherever you see server.com, it needs to be replaced with your domain name.
To implement LetsEncrypt, the following steps were taken:

1.git clone https://github.com/letsencrypt/letsencrypt64/opt/letsencrypt

2. mkdir /etc/letsencrypt

3. Create the following script and name it letsencrypt-renew.sh:
#!/bin/sh
DOMAIN=”vpn.server.com”
set -eu
/etc/init.d/openvpnas stop
/opt/letsencrypt/letsencrypt-auto certonly -c
/etc/letsencrypt/vpn.server.com.ini
/usr/local/openvpn_as/scripts/confdba -mk cs.ca_bundle -v “`cat
/etc/letsencrypt/live/$DOMAIN/fullchain.pem`”
/usr/local/openvpn_as/scripts/confdba -mk cs.priv_key -v “`cat
/etc/letsencrypt/live/$DOMAIN/privkey.pem`” > /dev/null
/usr/local/openvpn_as/scripts/confdba -mk cs.cert -v “`cat
/etc/letsencrypt/live/$DOMAIN/cert.pem`”
/etc/init.d/openvpnas start
4. Make the script executable with chmod: chmod +x letsencrypt-renew.sh
5. Make the following file and name it vpn.server.com.ini:
rsa-key-size = 4096
email = server@server.com
domains = vpn.server.com
authenticator = standalone
standalone-supported-challenges = tls-sni-01
agree-tos = True
keep-until-expiring = True
6. Run the script: ./letsencrypt-renew.sh
7.Create a backup of the ket files:
mkdir /root/keyfiles_bak
cp ./usr/local/openvpn_as/etc/web-ssl/* /root.keyfiles_bak
8.Add the certificates found in /etc/letsencrpt/live/vpn.server.com to the VPN through the web GUI. To do this, I sent the files to my host machine through SCP and performed the following steps:
Log into your vpn web GUI:
https://vpn.openvpn.com/admin
Under the configuration tab on the left, click on Web Server
Upload fullchain.pem in the Select CA bundle browser
Upload cert.pem in the Select Certificate browser
Upload the privkey.pem in the Select Private Key browser.
9.To automate the renewal process, we created a cronjob that will run every 90 days. The first step is to edit the crontab with the following command:
crontab -e
10.Next is to add the following line to the crontab: * * * */3 *
./letsencrpyt.sh
The integration of LetsEncrypt with OpenVPN allows for the use of signed certificates, creating a better and more secure environment.
https://twitter.com/taylor_melvin09
https://www.linkedin.com/in/taylor-melvin/

Thanks for reading this!! Stay safe and healthy out there 🙂

TeamCISO:

was formed in 2015 by a group of Cyber-security practitioners with experience in large enterprise. Our mission is to bring those frameworks and practices to help small to medium businesses get and stay cyber secure.

Our team can help you asses your current information Security and Privacy Controls to ensure that you are doing you due-diligence in managing your corporate risk profile.

If any gaps or vulnerabilities are discovered, our team will document these as well as define a road-map to remediation.

Set up a free 30 minute Cyber Security Consultation!

Leave a comment