I have a raspi at home with openvpn so I can safely browse the internet when I use my laptop or phone in a public place (coffee shop, bar, hotel...) that has open wifi.

I want make my openvpn server use elliptic curve cryptography. Im using openvpn 2.4 and openssl 1.0.1t. I tried rolling ec keys and certs on openssl and I keep failing.

So here are the files i need and the commands im trying to use in openssl:


ecparam -out /openvpn/easy-rsa/ecKeys/ecca.pem -name prime256v1 -genkey
ecparam -out /home/black/ecdh256.pem -name prime256v1


ecparam -out /etc/openvpn/easy-rsa/ecKeys/ecca.key -name prime256v1 -genkey
req -days 3650 -nodes -new -x509 -key /openvpn/easy-rsa/ecKeys/ecca.key -out /openvpn/easy-rsa/ecKeys/ecca.crt


ecparam -out /openvpn/easy-rsa/ecKeys/client.key -name prime256v1 -genkey


 req -days 3650 -nodes -new -key /openvpn/easy-rsa/ecKeys/client.key -out /openvpn/easy-rsa/ecKeys/server.csr


 ecparam -out /openvpn/easy-rsa/ecKeys/server.key -name prime256v1 -genkey


 req -days 3650 -nodes -new -key /openvpn/easy-rsa/ecKeys/server.key -out /openvpn/easy-rsa/ecKeys/server.csr


<have no idea>

Am I using the correct commands to create certs and keys i need to run in my openvpn server?

I cant seem to figure out how to create an EC ta key?

Can i use RSA for control channel and use EC for data channel or vise versa in openvpn?

Finals are coming up so I might not respond quickly. Im doing this for fun but I am sure other people will appreciate this as well. Thank you.

I found these two sites useful when creating my server if any one reading this is intrested:

Easy Windows Guide - openvpn -

Set up a Hardened OpenVPN Server on Debian

  • Welcome to Unix & Linux. While your question is in itself pretty complete, I would advise to break down problems in smaller units and create several questions. Dec 1, 2016 at 10:43

1 Answer 1


I am using gentoo with these packages. But my commentary is not distribution-specific.

net-libs/mbedtls-2.5.2:0/10::gentoo  USE="threads zlib -doc -havege -libressl -programs {-test}" ABI_X86="(64) -32 (-x32)" CPU_FLAGS_X86="sse2"
app-crypt/easy-rsa-3.0.1-r1::gentoo  USE="-libressl"
net-vpn/openvpn-2.4.3::gentoo  USE="lzo mbedtls pam plugins ssl down-root -examples -inotify -iproute2 -libressl -lz4 -pkcs11 (-selinux) -static -systemd {-test}"

Note on support: As of this writing, I need mbedtls as the backend for openvpn, and OpenVPN cannot be built with PKCS11 support at the same time. I am uncertain why, but the devs are aware of it. This has been true since at least February 2017.

Am I using the correct commands

I can't speak to that. I'm using easy-rsa to do what you are trying to directly use openssl for. This is not wrong. Easy-rsa just automates it. And despite the name, easy-rsa can be used for rolling an EC-based PKI.

Here are the relevant sections of my easy-rsa conf:

set_var EASYRSA_ALGO            ec
set_var EASYRSA_CURVE           brainpoolP512t1

EC for data channel

Wrong class of algo. The data channel is encrypted with a symmetric algo. EC is asymmetric. I will clarify this point if you ask me to.

ta.key [...] have no idea

The TA key file contains Diffe-Hellman params for initial session setup. It is independent of your choice of EC or RSA, and pertains to the way TLS negotiates sessions. Most of the value is in being able to reject traffic more quickly without having to check signatures and do key lookup before noticing the traffic is unauthenticated. You can use anyone else's instructions for defining and using this feature.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .