Generating VPN certificates

user-cert-generation.sh

# https://jamielinux.com/docs/openssl-certificate-authority/sign-server-and-client-certificates.html

# private key
openssl genrsa -aes256 -out private/user.name.key.pem 4096
# certificate request
openssl req -config openssl.cnf -key private/user.name.key.pem -new -sha256 -out csr/user.name.csr.pem
# sign with intermediate ca
openssl ca -config openssl.cnf -extensions usr_cert -days 375 -notext -md sha256 -in csr/user.name.csr.pem  -out certs/user.name.cert.pem
# bundle into pkcs12
openssl pkcs12 -export -out ./pkcs12/user.name.pfx -in certs/user.name.cert.pem -certfile certs/ca-chain.cert.pem -inkey private/user.name.key.pem
# review
openssl pkcs12 -info -in pkcs12/user.name.pfx