When I installed the openvpn server following these instructions, the work flow was like below

  1. Create ca.crt
  2. Create server.key and cert
  3. Create client.key and cert

As far as I know, when A and B are communicating with each other, A needs to keep A's private key secured and publish A's public key. So, B can encrypt the data with A's public key (in the certificate) and only A can decrypt with A's private key. Am I correct?

An example with OpenVPN: I think server can send the encrypted data to the client with the client's certificate and the client will be able to decrypt it with their private key. And vise versa.

So, the client doesn't need to keep server's private key or certificate files. But why does the server need to keep the client's private key and certificate files in the /etc/openvpn/easy-rsa/keys directory?

  • Why do you think the server needs to keep the client's private key?
    – Yuriko
    Sep 7, 2022 at 22:29
  • In many openvpn configuration instruction, they say create the directory for storing clients' key and cert files under /etc/openvpn/easy-rsa. digitalocean.com/community/tutorials/…
    – Hardguy
    Sep 7, 2022 at 23:19
  • See my answer, this tutorial only aims at getting you up-and-running for a personal use and should not be considered as an ultimate guide.
    – Yuriko
    Sep 8, 2022 at 8:37

1 Answer 1


You don't need to keep the client's private key on your CA/OpenVPN server, and therefore you should not.

Note that you understood correctly how asymmetric cryptography works, except that in practice we do not use that process to encrypt all the data sent between A and B. It's way too slow compared to symmetric algorithms. We use it at the beginning of a session so A and B can share a secret key that will then be used with a symmetric algorithm.

I believe that your server acts both as a CA and an OpenVPN server, you should not1. I will separate the 2 in this answer and focus on the CA role as it is the one that get to store the files in your example, but the reasoning applies even more to the OpenVPN server.

Easy-RSA is an utility used to create and manage a Certificate Authority, which can be used to either:

  1. Generate the server/clients private keys and signed certificates;
  2. Sign the certificates if the server/clients generated their private keys and certificates themselves.

At no point the CA needs to get ahold of and to store the private keys, they just happen to have them if you used Easy-RSA to generate them. This means that they should be discarded after being securely sent to the server/clients. The OpenVPN documentation confirms it. Regarding the certificate, they may be needed for revocation, but Easy-RSA has a copy elsewhere I believe.

In your tutorial, they decide to keep the private keys on the CA. I believe for convenience purposes, but I would advise against it as it adds an unnecessary risk: an illegitimate third party could get access to that directory and all the private keys. Note that if that third party compromises your whole CA you will have a separate2 but still big issue.

The private key is the technical 'proof' that someone is behind a certificate and the onus is on that person to secure them. Otherwise, you decrease the trust you can put into your PKI.

1: you should separate the 2 roles on different servers and keep the CA offline unless when necessary. It should not be as exposed as an OpenVPN server is.

2: if your CA is compromised, you would not be able to trust any certificates delivered. However, all your clients previous communications are still safe as long as their private keys are kept secret.

  • Hi, @yuriko, thanks for your explain. Is there any good instruction for the openvpn installation with separate ca and openvpn server?
    – Hardguy
    Sep 9, 2022 at 0:14
  • After further study, I realized that we don't need to keep the connection between CA server and openvpn server(if they are separate machines). So, ca.key was used for signing the server.cert initially. And it will be needed for signing clients cert files. So, we don't need to keep the connection between CA and openvpn server. Just need to keep the ca.key file safe in the CA server and it will be used for signing new client. And ca.crt file is not secret(as it's public key), so, it will be copied to openvpn server and clients to verify the each sides' cert file.
    – Hardguy
    Sep 9, 2022 at 5:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .