Laconic openvpn setup

cd /etc/openvpn
mkdir ccd
mkdir crl
mkdir keys
mkdir secret
chmod 700 keys secret
printf '00' > serial
touch index.txt

[ ca ]
default_ca               = CA_default
[ CA_default ]
dir                      = /etc/openvpn
crl_dir                  = $dir/crl
database                 = $dir/index.txt
new_certs_dir            = $dir/keys
certificate              = $dir/keys/CA_cert.pem
serial                   = $dir/serial
private_key              = $dir/secret/CA_key.pem
crl                      = $dir/crl/crl.pem
# crlnumber              = $dir/crlnumber
RANDFILE                 = $dir/secret/.rand
default_days             = 7300
default_crl_days         = 7300
# default_md             = md5
default_md               = sha256
unique_subject           = yes
policy                   = policy_any
x509_extensions          = user_extensions
[ policy_any ]
organizationName         = match
organizationalUnitName   = optional
commonName               = supplied
[ req ]
default_bits             = 4096
default_keyfile          = privkey.pem
distinguished_name       = req_distinguished_name
x509_extensions          = CA_extensions
default_md               = sha256
[ req_distinguished_name ]
organizationName         = Organization Name (must match CA)
organizationName_default = Company
organizationalUnitName   = Location Name
commonName               = Common User or Org Name
commonName_max           = 64
[ user_extensions ]
basicConstraints         = CA:FALSE
[ CA_extensions ]
basicConstraints         = CA:TRUE
default_days             = 7300
[ server ]
basicConstraints         = CA:FALSE
nsCertType               = server

  # Generate passwords using the commands:
cat /dev/urandom | tr -dc '[[:print:]]' | fold -w 256 | sed 's/ //g' | fold -w128 | head -n 1 > secret/CA_key.passwd
cat /dev/urandom | tr -dc '[[:print:]]' | fold -w 256 | sed 's/ //g' | fold -w128 | head -n 1 > keys/server_key.passwd

  # Creating a self-signed trusted certificate (CA)
openssl genrsa -aes256 -out secret/CA_key.pem 4096
openssl req -new -key secret/CA_key.pem -out keys/CA_csr.pem -subj "/C=NN/ST=None/L=None/O=OVPN-NET/OU=None/CN=OVPN-SERVER"
openssl x509 -req -in keys/CA_csr.pem -signkey secret/CA_key.pem -days 7300 -out keys/CA_cert.pem

  # Check
  # openssl req -in keys/CA_csr.pem -noout -text
  # openssl rsa -noout -text -in secret/CA_key.pem
  # openssl x509 -noout -text -in keys/CA_cert.pem

  # Creating a server certificate
openssl genrsa -aes256 -out keys/server_key.pem 4096
openssl req -new -key keys/server_key.pem -out keys/server_csr.pem -subj "/C=NN/ST=None/L=None/O=OVPN-NET/OU=None/CN=OVPN-SERVER"
openssl ca -batch -config openssl.cnf -extensions server -out keys/server_cert.pem -infiles keys/server_csr.pem

  # Check
  # openssl req -in keys/server_csr.pem -noout -text
  # openssl x509 -noout -text -in keys/server_cert.pem

openssl dhparam -out keys/dh4096.pem 4096
  # To revoke certificates
openssl ca -config openssl.cnf -gencrl -out crl/crl.pem
  # Check
  # openssl crl -noout -text -in crl/crl.pem
  # Certificate revocation, example
  # openssl ca -config openssl.cnf -revoke keys/user_cert.pem
  # After revocation, it is necessary to regenerate crl.pem
  # openssl ca -config openssl.cnf -gencrl -out crl/crl.pem
  # You can recreate the certificate using the existing user_csr.pem , user_key.pem and user_cert.pem no need to regenerate.
  # openssl ca -batch -config openssl.cnf -out keys/user-test_cert.pem -infiles keys/user-test_csr.pem
openvpn --genkey --secret keys/ta.key
  # Passwords to keys
chmod 400 keys/*
chmod 400 secret/*

cat /dev/urandom | tr -dc '[[:print:]]' | fold -w 256 | sed 's/ //g' | fold -w128 | head -n 1 > keys/user-laptop_key.passwd

openssl genrsa -aes256 -out keys/user-laptop_key.pem 4096
openssl req -new -key keys/user-laptop_key.pem -out keys/user-laptop_csr.pem -subj "/C=NN/ST=None/L=None/O=OVPN-NET/OU=None/CN=user-laptop"
openssl ca -batch -config openssl.cnf -out keys/user-laptop_cert.pem -infiles keys/user-laptop_csr.pem
chmod 400 keys/*
chmod 400 secret/*