Кстати, вы опубликовали все ключи для доступа к вашему ВПН. Рекомендую этот набор клиентских ключей больше никогда нигде не использовать.
mkdir -p ~/client-configs/files
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client-configs/base.conf
nano ~/client-configs/base.conf
remote ip_вашего_сервера 1194
proto udp
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
#ca ca.crt
#cert client.crt
#key client.key
cipher AES-256-CBC
auth SHA256
key-direction 1
# script-security 2
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
nano ~/client-configs/make_config.sh
#!/bin/bash
# First argument: Client identifier
KEY_DIR=~/client-configs/keys
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf
cat ${BASE_CONFIG} \
<(echo -e '') \
${KEY_DIR}/ca.crt \
<(echo -e '\n') \
${KEY_DIR}/${1}.crt \
<(echo -e '\n') \
${KEY_DIR}/${1}.key \
<(echo -e '\n') \
${KEY_DIR}/ta.key \
<(echo -e '') \
> ${OUTPUT_DIR}/${1}.ovpn
chmod 700 ~/client-configs/make_config.sh
client
dev tun
proto tcp
remote XXXXXXXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
verb 5
key-direction 1
<ca>
-------BEGIN CERTIFICATE-----
MIIDKzCCAhOgAwIBAgIJAIxTKM2wxLlqMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
BAMMCENBU2VydmVyMB4XDTE5MDEyMzE3NDcwOFoXDTI5MDEyMDE3NDcwOFowEzER
MA8GA1UEAwwIQ0FTZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDkfwjGbWdHspWhM/7b/dIzClah/F9TjUWRuO0FPVWjJS9QyJ//kBTeZajpzZlB
VQ9ohIQgqUB+flOYJk9gq+wDIOPd8N+QkJZNYNXVehAGVqjVmqhgofboW7n+6rd9
L366NY2/217nWnTtV3T9ojPITQaQefZrWszztPJtvhNaLjmKZ30omVLC9L+pYh12
yorwQuKxtHbnWWffQCKXdto7XkyMhMgenZ6W9diIQVnNtHWzXySja6YvQF49bWCx
Egz3Pg92OM1sQqmqlrfZRhhev1PeZy93kJG87vHlEoQZmI6xxnz2Kd1CR+kKJU3x
/Dbne98Zo8uSVx9g6iORbnCxAgMBAAGjgYEwfzAdBgNVHQ4EFgQU3NR+QzNGQ2mG
MQyWIvfmyj3zy+owQwYDVR0jBDwwOoAU3NR+QzNGQ2mGMQyWIvfmyj3zy+qhF6QV
MBMxETAPBgNVBAMMCENBU2VydmVyggkAjFMozbDEuWowDAYDVR0TBAUwAwEB/zAL
BgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBABeviJPEbIBHBtY5UZPzI8kR
Na7nqtY4Xa1JYVDop7gkCP28YZrmdevcE6dOewjMn6pJnD6fKMHSbQj27E+1nMLp
QCTGwvoZn9/mK/GPheCmEWNRmTGgkKXReK86kzFa4rlsvvTGxXkMBLG5YhA6/4Xs
Gn7Yu1RpC7ab4yZZu8RQ/3KtQ3QwBqTp23IyoZesYdgEcout448+zIu8r8ncup08
tPjmiNW9V8iml4oys98ShzEV+fKspMiD8KOlQsVWX7CldpruVZ+7W5rUN+CmoIIg
pUBPsf2onoLjVJL19TsTbn0yDo3InVSQiCQvydpvOWCCGgR1MfW5haKQ7MboINE=
-------END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
60:c9:df:5e:58:d2:e4:48:d5:4e:6d:3d:49:e4:c6:77
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=CAServer
Validity
Not Before: Jan 25 13:37:41 2019 GMT
Not After : Jan 9 13:37:41 2022 GMT
Subject: CN=client10
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:e4:01:ab:2b:ca:59:93:fa:73:89:8d:c4:47:b6:
1e:15:f0:a8:e4:4d:9f:96:cc:5d:6a:a9:87:a4:dd:
25:d3:db:f9:fa:70:59:b3:d9:a3:1b:20:8c:4f:6a:
c8:b5:1f:98:8b:99:bf:f3:3b:cf:36:89:e2:c2:45:
31:70:d4:7f:c1:c2:72:98:ec:82:11:47:84:0f:bc:
99:45:08:33:ef:a6:62:57:8e:44:df:3d:25:69:ad:
eb:14:f7:3b:44:e4:f8:09:a6:e1:43:84:ff:7b:84:
9c:0c:32:96:a4:67:03:16:70:dd:1d:02:2f:cc:8f:
7a:18:98:23:e0:98:64:38:9d:3d:a7:38:70:a2:35:
81:30:60:15:20:a6:5a:9f:8e:62:10:7a:67:45:c3:
ae:fd:00:cb:6e:99:e1:05:f3:29:dd:45:56:a6:0f:
73:18:62:c5:a0:0e:ec:c2:0e:a0:e1:0c:7c:35:8d:
5d:f4:05:a5:7e:90:00:67:df:12:be:c1:ba:e7:8d:
b3:d4:e5:27:a0:c7:fb:37:68:14:c5:2d:6d:91:8c:
25:a7:df:7e:f1:2f:88:d6:38:90:c3:1d:2e:e1:98:
a9:98:ad:78:52:50:31:fd:66:78:75:f4:15:43:01:
8a:82:3c:53:81:ec:49:9b:be:69:1d:d8:a9:fd:93:
34:4d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
08:68:38:20:B8:7D:65:F0:19:26:A2:0A:B0:A0:1B:FA:8B:F7:8C:54
X509v3 Authority Key Identifier:
keyid:DC:D4:7E:43:33:46:43:69:86:31:0C:96:22:F7:E6:CA:3D:F3:CB:EA
DirName:/CN=CAServer
serial:8C:53:28:CD:B0:C4:B9:6A
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
e0:fe:2f:47:89:29:05:23:40:d1:77:21:39:9a:a6:76:fe:1d:
1d:1d:6c:6f:92:6f:38:84:15:aa:a8:2d:9b:02:00:e5:79:f4:
06:69:9a:8d:7c:49:e0:c4:25:e1:4b:a5:26:43:75:35:3e:f5:
22:73:ab:9f:bc:f6:d6:6c:33:d1:d0:f4:ac:57:94:76:5d:2c:
14:b4:6f:10:57:b5:d5:7c:54:ab:15:e4:2e:d9:04:8c:68:2d:
76:a9:13:24:2f:ff:6e:f4:3d:5f:f8:96:80:23:8b:b2:18:6f:
75:24:f7:3f:43:23:04:c4:91:6a:99:7a:6f:2f:f7:64:a2:9b:
3a:98:a8:f7:1b:61:0f:b0:8e:0e:e6:af:74:20:57:6a:52:af:
9e:ff:48:6b:65:d8:aa:86:47:82:02:62:5b:26:39:ac:af:52:
d6:57:43:a3:22:18:e4:2c:fe:e9:e7:03:1e:20:cf:3b:f7:5b:
aa:eb:b3:06:ad:df:fa:4f:8c:1f:3f:83:b9:36:51:e4:c6:2c:
ff:4e:18:01:2b:42:fc:7d:15:54:c8:9a:aa:78:58:be:2d:79:
cd:a8:af:5c:01:12:91:b5:c0:f7:8b:bc:45:1e:62:56:98:50:
0f:9b:98:e1:4f:ac:72:bb:cc:14:fb:54:f9:67:e0:6d:f4:55:
e5:f7:06:2e
-------BEGIN CERTIFICATE-----
MIIDRTCCAi2gAwIBAgIQYMnfXljS5EjVTm09SeTGdzANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDDAhDQVNlcnZlcjAeFw0xOTAxMjUxMzM3NDFaFw0yMjAxMDkxMzM3
NDFaMBMxETAPBgNVBAMMCGNsaWVudDEwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA5AGrK8pZk/pziY3ER7YeFfCo5E2flsxdaqmHpN0l09v5+nBZs9mj
GyCMT2rItR+Yi5m/8zvPNoniwkUxcNR/wcJymOyCEUeED7yZRQgz76ZiV45E3z0l
aa3rFPc7ROT4CabhQ4T/e4ScDDKWpGcDFnDdHQIvzI96GJgj4JhkOJ09pzhwojWB
MGAVIKZan45iEHpnRcOu/QDLbpnhBfMp3UVWpg9zGGLFoA7swg6g4Qx8NY1d9AWl
fpAAZ98SvsG6542z1OUnoMf7N2gUxS1tkYwlp99+8S+I1jiQwx0u4ZipmK14UlAx
/WZ4dfQVQwGKgjxTgexJm75pHdip/ZM0TQIDAQABo4GUMIGRMAkGA1UdEwQCMAAw
HQYDVR0OBBYEFAhoOCC4fWXwGSaiCrCgG/qL94xUMEMGA1UdIwQ8MDqAFNzUfkMz
RkNphjEMliL35so988vqoRekFTATMREwDwYDVQQDDAhDQVNlcnZlcoIJAIxTKM2w
xLlqMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0B
AQsFAAOCAQEA4P4vR4kpBSNA0XchOZqmdv4dHR1sb5JvOIQVqqgtmwIA5Xn0Bmma
jXxJ4MQl4UulJkN1NT71InOrn7z21mwz0dD0rFeUdl0sFLRvEFe11XxUqxXkLtkE
jGgtdqkTJC//bvQ9X/iWgCOLshhvdST3P0MjBMSRapl6by/3ZKKbOpio9xthD7CO
DuavdCBXalKvnv9Ia2XYqoZHggJiWyY5rK9S1ldDoyIY5Cz+6ecDHiDPO/dbquuz
Bq3f+k+MHz+DuTZR5MYs/04YAStC/H0VVMiaqnhYvi15zaivXAESkbXA94u8RR5i
VphQD5uY4U+scrvMFPtU+WfgbfRV5fcGLg==
-------END CERTIFICATE-----
</cert>
<key>
-------BEGIN ENCRYPTED PRIVATE KEY-----
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIPlHe5yMhM6cCAggA
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECJuCPcPNL0kqBIIEyLboMU0X/3Wh
htyvvUxBL8KKwHnSkHhzCf7HhMPSG9OuI8dpr+fqUMIRO64y5+ztrzBCn5i6Vb4w
AbkOlAn4tolfu8UrcPDBLaxn050HyrwFtaywh2x1t8vy3RSAHOM16TRYmnZBDBqK
c/ixQ2cO3B9x8jjexmcpPlJaFsig41XGuVKQcY/uVwbBi4RsYQaBcuWJpngkApI0
Y1BApoxMnOFwIr3+rwzmTekBE38Px86zU66SVGJ6EpZBk7XDzyeSLSpQn5lCHS1i
2ZLThaAfOTuGFb22XRXvcYiYrh4OYN8xYqdLvr0t9uMkqzAcil3e1Fh518wB0j14
N/babJ1P9V3WQ7YfuKGQi/yB10i4SuuPwEjjGZNcakYmUEvIsVsXLsSPrg48Rm5v
ndVlzkn42s5is5dfjmxxK1l/kmyxR19mGBzBg0MxJuyqXFOcojoDgZ5J/sdWh28n
8qyC2qd4ougy6G2dfPxCBBied7App8HuJng5aWbB3HHFws87Wll6AEgF7uv/LX4t
4WRO7Cuo4kl3mf4k4ZWqmd6YT4TfAZmmikX3Apg3lkUGWBa+LCeH/Q1iopEIjXnP
vnh3HeUfBRkDIbPNMHQFs0drUr+OdZG+UqYHlIPmJk6MaX8i8BBClxFvExcyt4zl
4dC4zEAD7x3XGrbJWdLO0wMHtQkkg1dKVtMaWkQLEebFiqmGCzSf9nuy5JNDNneS
rXXdMfxFZbvrVEoB0t5XFf0ZqkGX3Izl1prjoWeacc/Yseb+8JsUJlBu1qBmoSrM
ynJiYLT2CJ6Jb2uZ8FAQitd6BrbXr9g6nyP8FZaQmfdAac6qeOFDNNDfNUIGs1Lw
oaopiPN/4cK1gHhIPtvE0KO/uuSjNn/q2bMVSnIxaF9AK5TRmvs4MvpFqP8UUJIq
EdaBqlZl4pbS0If/ndpivXfhCOrfjPQ/FdQJGdHByrnoUwUqVShxPlyB7z2af8hN
sr5ClOH1fnicSXHHnutQdWc860ZXnrVuYv1EnJPBoDJpv7lrWgmsGeNRgXP9Prut
yiGnQG/r8QiGtBrFS5d+9tHvn8QLhbCXgqF3B8fPIA7XxhxHJytSCqy5vVO+gtHy
BmXs748UIIohjPuMpj6pBQ08y+N6QiDR+l9G/rUAlRC+l4GObzCrUl9IJDCbL5tO
uPjrVqClreXzPfJD006Th3Yj4EVQ7tluzyJG0OJwYZy+htY96ChcaZ8Egf+B7Zgn
1Z9Oxj5Y4E4zU15C/7WxdSCMseNMyQtgiVnuMahYeqlyEPdjMesaXZM7Q8hFgpFV
v8zG0KE8pay86t4q3KVya3KQLtyIglMzPlRIETuymTQVCXbqZwTy7lfNV6shcqib
x0y9sqIJ04dp92rHcszJyLyDpMAjEjnuiOlE5sOaxUtiDdlJU+p5nVe8gFG0mlhq
ZzuEKVy8hiPPzBm3q6uakUHfm7Cljo7HmhD6AretsAnQUGuqfVI4+7F+pMZziky2
ejm6PLj/NwO3BLUBbdJNMzmQmu+1Oigy+thvgacn4D3CP79wvuJKFDKWYMYCe0sH
gCsysRysKp75OXLKZkCDccmwex6XTVDappS5hfZioIJVRBwLwrUMrYOH22bBMaZc
DgvYUqZKVwJARqE/fjdRlQ==
-------END ENCRYPTED PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-------BEGIN OpenVPN Static key V1-----
ddf27ce5d3f6ef2a6c0e497bc1033b85
3f36de45cabaf07ad8e48f0495879526
2944c20a9732f3bd8a96999da28be900
006473c4f33b1f37721a638a6a6045e9
f776acebe8196e2b605e0e644c32f430
caee27ca352498def95e15c90379cb55
afac0f48f1ed81cc8fb86cd86653c571
76ba426b060cdc68add57eea648c8658
1a01ada715c726f1c6dfcb1ebf0f8a9a
93e3aaa42cea2bc2cb270319b4ada2c9
27f708c2fd8b3657482c5cf8e28284e9
ca70760ad1121b566b88ce7e337b6eca
e2d3bb2cf6756a56b3245962637ff9e3
ed0a379b350969a3960bbcd428347904
80a84769749d5132e0fce92e19576acc
bd1c5073ee07bfd330a2c3b00686db6c
-------END OpenVPN Static key V1-----
</tls-auth>
Enter Management Password:
Mon Feb 04 09:46:51 2019 us=55539 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Feb 04 09:46:51 2019 us=55539 Need hold release from management interface, waiting...
Mon Feb 04 09:46:51 2019 us=500569 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Feb 04 09:46:51 2019 us=602563 MANAGEMENT: CMD 'state on'
Mon Feb 04 09:46:51 2019 us=602563 MANAGEMENT: CMD 'log all on'
Mon Feb 04 09:46:51 2019 us=827493 MANAGEMENT: CMD 'echo all on'
Mon Feb 04 09:46:51 2019 us=830493 MANAGEMENT: CMD 'bytecount 5'
Mon Feb 04 09:46:51 2019 us=832493 MANAGEMENT: CMD 'hold off'
Mon Feb 04 09:46:51 2019 us=834493 MANAGEMENT: CMD 'hold release'
Mon Feb 04 09:46:51 2019 us=838493 OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
Mon Feb 04 09:46:51 2019 us=840493 OpenSSL: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Mon Feb 04 09:46:51 2019 us=840493 MANAGEMENT: Client disconnected
Mon Feb 04 09:46:51 2019 us=840493 Cannot load inline certificate file
Mon Feb 04 09:46:51 2019 us=840493 Exiting due to fatal error
location / {
try_files $uri $uri/ /index.php?q=$uri & $args;
}
location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
access_log off;
expires max;
}
location ~ /\.ht {
deny all;
}
location ~ \.php$ {
fastcgi_index index.php;
fastcgi_keep_conn on;
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/run/php/php7.1-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}