Setting-up primary CA

First of all, you must setup your Certification Authority, later called CA.

It's true that OpenVPN carries its own scripts (easy-rsa) for setting up a little CA infraestructure, based in openssl, and perhaps they are enough for what you need. But gnoMint lets you to manage the CA in a more confortable way, always seeing the current status of your installation. And with gnoMint you can look further than a simply VPN-oriented CA.

By the way: if you already have a OpenSSL CA (as the ones made through openssl's CA script, tinyCA, OpenVPN's easy-rsa...), you must know that gnoMint, since 0.6.0 version, can import them into a gnoMint database.

Before launching any application, let's think a little bit about the CA we are going to create. In this example we want to create a single Root Certification Authority for your firm, so we control all the issued certificates from only one database. This Root Certification Authority will issue CA-capable certificates, that will be specialized (as it is recommended that a given CA issues certificates with the same properties).

• We will create a second-level CA for VPN system identification (the example firm will use OpenVPN).
• Another secondary CA for identifying employees in the firm (perhaps for using for transmitting top-secret information through mail).
• And another for software signing (as the Software Development Department wants to sign all the security patches so the produced software can upgrade only with chryptographically signed patches).