The script is located at /etc/openvpn/ivr-add-client.sh. According to the Easy-rsa documentation, when the CA in on the same machine, it is unnecessary to do the import of requests.

The script has to be run as root or a sudo user. The format is :

# cd /etc/openvpn
# ./ivr-add-client.sh client_common_name

• converts the client common name to lowercase
• checks if the client is already exists. If true, exit the script.
• generates the certificate signing request (CSR).
• signs the CSR
• copies the generated client certificate and client key to /etc/openvpn/innovr-client-configs/keys
• generates the ovpn file for the client.

#!/bin/bash

# Innovr OpenVpn - Add a client.
# This script generate a certificate and key pair for the client,
# and create a client configuration file (.ovpn) for importing to
# the client device.

# Run as root and put the client Common Name as the 1st argument.

# For example: # ./innovr-add-client.sh client1

# check the length of arguments
if [ $# -eq 0 ]; then
        echo " "
        echo "*** Warning: No client common name supplied...!"
        echo ""
        exit 1
fi

CLIENT=${1,,}  #convert $1 to lowercase
PkiDir="/home/tfw/easy-rsa/pki"

# check existence of client
CLIENTEXISTS=$(tail -n +2 $PkiDir/index.txt | grep -c -E "/CN=$CLIENT\$")

if [[ $CLIENTEXISTS == '1' ]]; then
	echo ""
	echo "*** Warning: The client CN '$CLIENT' has already been used. Please choose another name."
	echo ""
	exit 1
fi

# Generate and sign the certificate signing request (CSR)
cd /home/tfw/easy-rsa
echo ""
./easyrsa --batch gen-req $CLIENT  #--batch is to stop sending out notice & other messages
echo ""
./easyrsa --batch sign-req client $CLIENT

# Copy the crt and keys to openvpn
cp pki/private/$CLIENT.key /etc/openvpn/innovr-client-configs/keys
cp pki/issued/$CLIENT.crt /etc/openvpn/innovr-client-configs/keys

# Generate the .ovpn file for the client
/etc/openvpn/innovr-client-configs/make-client-config.sh $CLIENT

The script is located at /etc/openvpn/ivr-remove-client.sh.

The script has to be run as root or a sudo user. The format is :

# cd /etc/openvpn
# ./ivr-remove-client.sh client_common_name

• converts the client common name to lowercase
• checks if the client is already exists. If false, exit the script.
• revoke the client cert (./easyrsa revoke ‘client’)
• create an updated certificate revoke list (CRL) that contains all revoked certs (./easyrsa gen-crl)
• remove crl.pem on openvpn/server directory and copy the new crl.pem to it. Run chmod 644.
• Remove the ovpn file in …./openvpn/innovr-client-configs/files directory
• Remove the crt and key files in …./openvpn/innovr-client-configs/keys directory
• remove the client entry in …./server/ipp.txt using sed
• make a backup of …./pki/index.txt (i.e. index.txt.backup)
• run ./easyrsa update-db (this should update the index.txt with the new status)
• Restart openvpn service – systemctl restart openvpn-server@ovpn-server

#!/bin/bash

# Innovr OpenVpn - Remove a client.
# This script performs the following:
# - revoke the client cert (./easyrsa revoke 'client')
# - create an updated certificate revoke list (CRL) that contains all revoked certs (./easyrsa gen-crl)
# - remove crl.pem on openvpn/server directory and copy the new crl.pem to it. Run chmod 644.
# - remove the ovpn files in the pki directory and the openvpn/innovr-client-configs-files directory
# - remove the crt and key files in ..../openvpn/innovr-client-configs/keys directory
# - backup ipp.txt and update the ipp.txt record using sed
# - run ./easyrsa update-db (this should update the index.txt with the new status)
# - restart openvpn service

# Run as root and put the client Common Name as the 1st argument.
# For example: # ./ivr-remove-client.sh client-109

# client-109 footprints
# -/etc/openvpn/innovr-client-configs/files/client-109.ovpn
# -/etc/openvpn/innovr-client-configs/keys/client-109.crt
# -/etc/openvpn/innovr-client-configs/keys/client-109.key
# -/home/tfw/easy-rsa/pki/issued/client-109.crt
# -/home/tfw/easy-rsa/pki/private/client-109.key
# -/home/tfw/easy-rsa/pki/reqs/client-109.req

# check the length of arguments
if [ $# -eq 0 ]; then
        echo " "
        echo "*** Warning: No client common name supplied...!"
        echo ""
        exit 1
fi

EasyRsaDir="/home/tfw/easy-rsa"
PkiDir="$EasyRsaDir/pki"
ServDir="/etc/openvpn/server"
ClientConfigDir="/etc/openvpn/innovr-client-configs"

CLIENT=${1,,}  #convert $1 to lowercase

# check existence of client
CLIENTEXISTS=$(tail -n +2 $PkiDir/index.txt | grep -c -E "/CN=$CLIENT\$")

if [[ $CLIENTEXISTS == '0' ]]; then
        echo ""
        echo "*** Warning: The client CN '$CLIENT' does not exist, please check...!"
        echo ""
        exit 1
fi

cd $EasyRsaDir || exit 1  # if cd failed, run exit

./easyrsa --batch revoke "$CLIENT"

./easyrsa gen-crl
rm -f $ServDir/crl.pem
cp $PkiDir/crl.pem  $ServDir
chmod 644 $ServDir/crl.pem

rm -f $ClientConfigDir/files/$CLIENT.ovpn
rm -f $ClientConfigDir/keys/$CLIENT.crt
rm -f $ClientConfigDir/keys/$CLIENT.key

sed -i.backup "/^$CLIENT,.*/d" $ServDir/ipp.txt  # must add suffic '.backup' otherwise won't delete

./easyrsa update-db

systemctl restart openvpn-server@ovpn-server

echo ""
echo "*** Notice:"
echo "VPN client $CLIENT has been revoked."

The script is located at /etc/openvpn/ivr-show-clients.sh.

The script has to be run as root or a sudo user. The format is :

# cd /etc/openvpn
# ./ivr-show-clients.sh

The script is to list all client records in the index.txt file under the PKI directory

#!/bin/bash

# Innovr OpenVpn - Show all active certificates

# Run as root without argument
# For example: # ./ivr-show-all.sh

EasyRsaDir="/home/tfw/easy-rsa"
PkiDir="$EasyRsaDir/pki"
ServDir="/etc/openvpn/server"
ClientConfigDir="/etc/openvpn/innovr-client-configs"

echo ""
cat  $PkiDir/index.txt
echo ""