How to protect public and private keys

Posted on 2008-10-30
Medium Priority
Last Modified: 2012-05-05
Hi there,

I've recently set up open vpn.

On my windows box (the client) I have put a ca.crt and client1.crt and client1.key into the config directory. These keys were made on a totally seperate server (different from the openVPN server).

If someone got a hold of my ca.crt, what would stop them from creating their own client keys on a server of their own, and using them to connect to my vpn?

Question by:jonnytabpni
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3

Expert Comment

ID: 22848226
It is recommended to keep the Private Keys on a separate disk like USB Drives etc. But why you want to protect the Public Keys?

Author Comment

ID: 22848233
can't someone just create their own private keys themselves?

All I had to do was use easy-rsa and run ./build-key client1

Is ca.crt a public or private key?

Expert Comment

ID: 22848247
Even if someone creates a private key, they will not be able to decrypt. Creation of keys includes randomly generated data which is continuously refreshed. It will always be unique.
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 22848256
I'm really sorry but my knowledge of PKI is very bad!

I understand that no one will be able to decrypt unless they use the correct private key.

But my question is that, if someone creates their own private key, will they be able to connect to the vpn and use my resources?

Accepted Solution

rpkhare earned 1500 total points
ID: 22848291
I have no knowledge of VPN. But in case your VPN requires your Private Key for login then no other private key will work.

Author Comment

ID: 22848302
hmm that's the thing I'm not sure about. I generated all my certs and keys on a totaly seperate server.

The openVPN server didn't have an option to specify *which* private keys are allowed..

Expert Comment

ID: 22848318
Here you can find how it works:

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Suggested Courses
Course of the Month8 days, 18 hours left to enroll

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question