Skip to content

OpenVPN remote access#

MIVO Connect includes an OpenVPN server for secure remote access to the device and its local network.

Access is authenticated with client certificates. Create one certificate per person or computer that needs access.

This guide explains how to create your own Certificate Authority (CA), issue client certificates, configure MIVO Connect and OpenVPN Connect, and manage access securely.

Overview#

The VPN uses certificate authentication in both directions.

Certificate Purpose
Your CA certificate Installed on MIVO Connect so it can verify your OpenVPN clients.
MIVO CA certificate Used by the OpenVPN client to verify the MIVO Connect device.
Client certificate Identifies one authorised user or computer.
MIVO Connect server certificate Identifies the MIVO Connect device.

Info

The two CA certificates have different purposes. Do not confuse the ca.crt you create with the MIVO CA certificate supplied for the OpenVPN client.

1. Install EasyRSA#

EasyRSA is used to create and manage your CA and client certificates.

  1. Download the latest Windows release from EasyRSA releases on GitHub.
  2. Extract the ZIP file to a suitable folder, for example C:\EasyRSA.
  3. Start EasyRSA-Start.bat in the extracted folder.

A terminal window opens where you can run the commands below.

2. Create your Certificate Authority#

This is normally done once, by the administrator responsible for VPN access.

easyrsa init-pki
easyrsa build-ca

EasyRSA asks you to set a password and a Common Name for the CA. Use a descriptive name, for example Customer OpenVPN CA.

The public CA certificate is created at:

pki/ca.crt

Warning

The CA private key is stored under the EasyRSA PKI directory, normally as pki/private/ca.key. Keep the complete PKI directory, and particularly this private key, securely protected.

Anyone with the CA private key can issue client certificates trusted by MIVO Connect. Do not upload, email or distribute the CA private key.

The pki/ca.crt file contains only the public CA certificate. It is safe to install on MIVO Connect.

3. Create a client certificate#

Create a separate certificate for each person or computer. For example, for a service laptop:

easyrsa build-client-full service-laptop
easyrsa export-p12 service-laptop

The resulting PKCS#12 file is normally created as:

pki/private/service-laptop.p12

The .p12 file contains the client certificate and its private key. It may also include the certificate chain.

Warning

Treat a .p12 file and its export password as a login credential. Anyone possessing both may be able to connect as that client.

Do not share certificates between users. Individual certificates make it possible to identify and revoke access for one computer without affecting everyone else.

4. Configure MIVO Connect#

MIVO Connect needs the public certificate for your CA to decide which clients to trust.

  1. Open System → Services → OpenVPN → Upload new client CA certificate on the MIVO Connect web interface.
  2. Upload the following file:

text pki/ca.crt

Do not upload pki/private/ca.key or the whole EasyRSA PKI folder.

Once the CA certificate is installed, MIVO Connect accepts client certificates issued by that CA, provided that they are valid and have not been revoked.

5. Configure OpenVPN Connect#

Install OpenVPN Connect on the computer that will access MIVO Connect.

You need these files:

exempel.ovpn
mivoca.crt
service-laptop.p12

The accompanying files are:

Keep exempel.ovpn and mivoca.crt in the same folder. The profile contains the line ca mivoca.crt, so OpenVPN needs to find the certificate using that exact file name.

mivoca.crt is supplied by MIVO. It allows the OpenVPN client to verify the certificate presented by MIVO Connect.

Info

mivoca.crt is not the same as your pki/ca.crt.

  • Your pki/ca.crt: MIVO Connect uses it to verify your client certificate.
  • MIVO mivoca.crt: Your OpenVPN client uses it to verify MIVO Connect.

Set the server address#

Open exempel.ovpn in a text editor and locate the first line:

remote <IP> <PORT>

Replace the address and port with the public IP address or hostname and OpenVPN port for the MIVO Connect installation. Save the file.

For example:

remote vpn.example.com 1194

The supplied profile also contains remote-cert-tls server, which ensures that the peer presents a certificate intended for a VPN server, and auth-nocache, which prevents OpenVPN from retaining the private-key password in memory after use.

Import the profile#

  1. Open OpenVPN Connect.
  2. Open the menu and select Certificates & Tokens.
  3. Select Add certificate, choose service-laptop.p12, and enter the export password.
  4. Return to the main screen, select the plus icon, then choose File under Import Profile.
  5. Import exempel.ovpn.
  6. Under Certificate & key, select Assign and choose the certificate you imported.
  7. Save the profile and select Connect.

How the security works#

The solution uses mutual TLS authentication. Both sides hold a private key, but neither private key is sent over the network.

During connection setup, each side proves that it holds its private key and validates the certificate presented by the other side.

MIVO Connect verifies the client#

MIVO Connect receives the client certificate and verifies that it:

  • is issued by the customer CA installed on the device;
  • is within its validity period.

A certificate issued by an unknown CA is rejected.

The client verifies MIVO Connect#

The OpenVPN client validates the server certificate presented by MIVO Connect against mivoca.crt. This protects against connecting to an untrusted server that merely claims to be a MIVO Connect device.

Encryption#

After mutual authentication succeeds, OpenVPN establishes encrypted session keys for the VPN connection. Data travelling through the tunnel is encrypted and integrity-protected, so it cannot normally be read or altered by someone observing the network traffic.

Note

Certificate authentication protects who may establish the VPN connection. Normal network security still matters: protect administrator accounts, keep device firmware current, and restrict access to the VPN port with firewall rules where appropriate.

  • Keep the CA private key offline or in access-controlled storage, with a secure backup.
  • Use one certificate per person or computer, with meaningful names such as laptop-anna or service-pc-01.
  • Protect .p12 files with strong, unique passwords and send the file and password through separate channels.
  • Record who received each certificate and when it expires.
  • If a client certificate is compromised, replace the trusted CA certificate and issue new client certificates.
  • Never use the CA private key on MIVO Connect or on ordinary service laptops.