I'm creating my own openvpn server.
The Certificat authority is located on a separated host.
There is two kind of clients: which that just send a
.csr and to which i send the
.crt as an answer and the other which I build myself.
In the second case, I create the
.csr by using:
openssl req -days 3652 -nodes -new -keyout NewClient007.key -out NewClient007.csr
than the signed certificat by:
openssl ca -days 3652 -out NewClient007.crt -in NewClient007.csr
So, from there, I will install both
.crt to the new client and delete
.key from the CA.
If I rightly understand, the
.crt may be usefull if I want to revoke the key, in futur (but is copied to
Id.pem, where Id is the index number).
Current status, where ssl files are located:
server: ca.crt CA's public certifcate server.crt server public certifcate server.key server private key crl.pem CA signed certificates revokation list dh1024.pem Diffie-Hellman parameters file certificate authority: ca.key CA's private key ca.crt CA's public certifcate index.txt Index of signed keys serial number of next entry in index.txt index.txt.attr attributes for index file ClientXXXX.crt All clients certificates ClientXXXX.csr All clients signing requests YY.pem Copy of clients certificates according to index nr. clients: ca.crt CA's public certifcate ClientXXXX.crt The client certificat ClientXXXX.key The client key
When I build the client key myself, they are immediately shred and deleted once installed in client.
So I think (but not sure) I could quietly delete all
ClientXXXX.crt from CA...
... So there is my question:
could I ever need to access
.csr file again or could I definitively delete them?