deb http://ftp.debian.org/debian jessie-backports main
更新软件列表:
apt-get update
这里推荐将debian8.6的163源改为阿里云的源：
deb http://mirrors.aliyun.com/debian/ jessie main non-free contrib
deb http://mirrors.aliyun.com/debian/ jessie-proposed-updates main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ jessie main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ jessie-proposed-updates main non-free contrib
安装openvpn
apt-get -t jessie-backports install openvpn
检查openvpn版本
安装apt-showversions
apt-get install apt-show-versions
检查版本是否为2.4.0-3~bpo8+1
apt-show-versions openvpn
openvpn服务器配置（debian8.6）
使用easy-rsa 2.2.2-1生成服务端证书
生成主CA证书和密钥 默认目录为 /usr/share/easy-rsa/
cd /usr/share/easy-rsa/
. ./vars
./clean-all
./build-ca
最后一个命令(build-ca)将通过调用交互的openssl命令来创建CA证书和密钥。
root@debian:/usr/share/easy-rsa# ./build-ca
Generating a 2048 bit RSA private key
.............................+++
...........+++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:CN
State or Province Name (full name) [CA]:Hn
Locality Name (eg, city) [SanFrancisco]:Changsha
Organization Name (eg, company) [Fort-Funston]:farseer
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:farseer
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:VDS
Name [EasyRSA]:farseer
Email Address [me@myhost.mydomain]:farseer@farseer.cc
生成服务端证书、密钥
./build-key-server server
在这一步骤中，大多数参数都可以使用默认值。当询问Common Name时，请输入服务器名。此外，有两个询问操作必须正面响应：“Sign the certificate? [y/n]“和"1 out of 1 certificate requests certified, commit? [y/n]".。
root@debian:/usr/share/easy-rsa#
./build-key-server vds
Generating a 2048 bit RSA private key
.............................................
.............................................
..............................+++
.....+++
writing new private key to 'vds.key'
-----
You are about to be asked to enter
information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:CN
State or Province Name (full name) [CA]:Hn
Locality Name (eg, city) [SanFrancisco]:Changsha
Organization Name (eg, company) [Fort-Funston]:farseer
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:farseer
Common Name (eg, your name or your server's hostname) [vds]:
Name [EasyRSA]:farseer
Email Address [me@myhost.mydomain]:farseer@farseer.cc
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:farseer2017
An optional company name []:farseer
Using configuration from /usr/share/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'Hn'
localityName :PRINTABLE:'Changsha'
organizationName :PRINTABLE:'farseer'
organizationalUnitName:PRINTABLE:'farseer'
commonName :PRINTABLE:'vds'
name :PRINTABLE:'farseer'
emailAddress :IA5STRING:'farseer@farseer.cc'
Certificate is to be certified until Mar 19 12:26:21 2027 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
