First, make sure you've got a clean slate with nothing left over from previous installations:

# cd /usr/share/easy-rsa 
# . ./vars 
# ./clean-all 

Next, create the Certificate Authority key with the build-ca command. This command will prompt you for information about your site. You'll have to enter this information several times. Substitute your name, e-mail, site name, and so on for the values in this recipe. The required information varies slightly between commands. Only the unique sections will be repeated in these recipes:

# ./build-ca 
Generating a 2048 bit RSA private key 
......+++ 
.....................................................+++ 
writing new private key to 'ca.key' 
----- 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For somefieldsthere will be a default value, 
If you enter '.', the field will be left blank. 
----- 
Country Name (2 letter code) [US]: 
State or Province Name (full name) [CA]:MI 
Locality Name (eg, city) [SanFrancisco]:WhitmoreLake 
Organization Name (eg, company) [Fort-Funston]:Example 
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:Packt 
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:vpnserver 
Name [EasyRSA]: 
Email Address [me@myhost.mydomain]:admin@example.com 
 
Next, build the server certificate with the build-key command: 
# ./build-key server 
Generating a 2048 bit RSA private key 
..................................+++ 
.....................+++ 
writing new private key to 'server.key' 
----- 
You are about to be asked to enter information that will be incorporated 
into your certificate request.... 
 
 
 
 
 
Please enter the following 'extra' attributes 
to be sent with your certificate request 
A challenge password []: 

Create a certificate for at least one client. You'll need a separate client certificate for each machine that you wish to connect to this OpenVPN server:

# ./build-key client1 
Generating a 2048 bit RSA private key 
.......................+++ 
.................................................+++ 
writing new private key to 'client1.key' 
----- 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
...  
 
 
 
 
Please enter the following 'extra' attributes 
to be sent with your certificate request 
A challenge password []: 
An optional company name []: 
Using configuration from /usr/share/easy-rsa/openssl-1.0.0.cnf 
Check that the request matches the signature 
Signature ok 
The Subject's Distinguished Name is as follows 
countryName  :PRINTABLE:'US' 
stateOrProvinceName  :PRINTABLE:'MI' 
localityName  :PRINTABLE:'WhitmoreLake' 
organizationName  :PRINTABLE:'Example' 
organizationalUnitName:PRINTABLE:'Packt' 
commonName  :PRINTABLE:'client1' 
name                  :PRINTABLE:'EasyRSA' 
emailAddress:IA5STRING:'admin@example.com' 
Certificate is to be certified until Jan  8 15:24:13 2027 GMT (3650 days) 
Sign the certificate? [y/n]:y 
 
 
1 out of 1 certificate requests certified, commit? [y/n]y 
Write out database with 1 new entries 
Data Base Updated 

Finally, generate the Diffie-Hellman with the build-dh command. This will take several seconds and will generate a few screens filled with dots and plusses:

# ./build-dh 
Generating DH parameters, 2048 bit long safe prime, generator 2 
This is going to take a long time 
......................+............+........ 

These steps will create several files in the keys folder. The next step is to copy them to the folders where they'll be used.

Copy server keys to /etc/openvpn:

# cp keys/server* /etc/openvpn 
# cp keys/ca.crt /etc/openvpn 
# cp keys/dh2048.pem /etc/openvpn 

Copy the client keys to the client system:

# scp keys/client1* client.example.com:/etc/openvpn 
# scp keys/ca.crt client.example.com:/etc/openvpn