Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-12-29 14:17:03 +01:00
Code Issues Projects Releases Wiki Activity

fix: copy server key + add nopass for server renewal in fingerprint mode

Browse Source
This commit is contained in:
Stanislas Lange
2025-12-29 11:26:35 +01:00
parent 80778b925b
commit 3ed7237aac
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
openvpn-install.sh
View File

@@ -4224,13 +4224,14 @@ function renewServer() {
# Backup the old certificate
run_cmd "Backing up old certificate" cp "pki/issued/$server_name.crt" "pki/issued/$server_name.crt.bak"
# Delete old certificate files (keep private key)
# Delete old certificate files (all must be removed for self-sign-server to work)
run_cmd "Removing old certificate" rm -f "pki/issued/$server_name.crt"
run_cmd "Removing old private key" rm -f "pki/private/$server_name.key"
run_cmd "Removing old certificate request" rm -f "pki/reqs/$server_name.req"
# Generate new self-signed server certificate
export EASYRSA_CERT_EXPIRE=$server_cert_duration_days
run_cmd_fatal "Generating new server certificate" ./easyrsa --batch --days="$server_cert_duration_days" self-sign-server "$server_name"
run_cmd_fatal "Generating new server certificate" ./easyrsa --batch --days="$server_cert_duration_days" self-sign-server "$server_name" nopass
# Extract the new fingerprint
local new_fingerprint
@@ -4244,8 +4245,9 @@ function renewServer() {
echo "$new_fingerprint" >/etc/openvpn/server/server-fingerprint
log_info "New server fingerprint: $new_fingerprint"
# Copy the new certificate to /etc/openvpn/server/
# Copy the new certificate and key to /etc/openvpn/server/
run_cmd_fatal "Copying new certificate" cp "pki/issued/$server_name.crt" /etc/openvpn/server/
run_cmd_fatal "Copying new private key" cp "pki/private/$server_name.key" /etc/openvpn/server/
# Regenerate all client configurations (they contain the server fingerprint)
log_info "Regenerating client configurations with new server fingerprint..."