Welcome back to part two
of this demo series.
Now, we can only continue with this
once the directory has moved into the active state,
and we can see in my case that it has.
Now, in part two,
we're going to be creating the server certificate
that the client VPN is going to use.
A client VPN is capable
of using either identity-based authentication
or certificate-based authentication.
So which one you choose determines
which certificates you need to create.
Now, because we're using this architecture,
so we're using identity-based authentication,
all we need to do is to create a server certificate.
Now, there is some command line work
that we need to do to create this certificate,
and the exact steps that you need to perform
are different based on the operating system
that you're using on your local machine.
If you're using Linux or macOS,
then you need to use one set of instructions,
and if you're using Windows,
you need to use a different set.
Both of these are detailed in the instructions,
which are attached to this lesson.
In my case, I'm using macOS,
so I'll be following the Linux and macOS steps.
So I'm gonna go ahead and move across to my terminal.
Once I'm at my terminal,
I'm going to move into a temporary directory.
So I'm going to use cd /tmp.
And we're going to be using a utility called easy-rsa
to create the certificate.
So the first thing that we need to do
is to use Git to clone this repository,
so this utility down to our local machine.
So this is the command I'll be using, git clone,
and then the address to the easy-rsa repository.
So I'll run that to clone that down.
That will take a few seconds,
and once it's finished cloning,
I'll need to move into that folder using this command.
So cd easy-rsa/easyrsa3.
Now, as I mentioned, we're only going
to be creating a server certificate for this demo lesson
but there are a few steps that we need
to perform to get that certificate.
The first is that we need to use the easy-rsa utility
and then the init-pki command
to initialize this so we can create the certificate.
So go ahead and run that command.
That should be relatively quick,
and just put you straight back at the terminal.
Next, we need to use this command.
So easyrsa build-ca nopass.
And we need to do this
so that we can create a server certificate.
So run that command and press Enter,
and then just type yes and press Enter again.
And that will put you back at the terminal.
I'm just gonna clear the screen
to make it easier to see
and then we'll run this final command.
So this is easy-rsa build-server-full.
We're going to build a server certificate with nopass.
So run that command.
It will take a few seconds
and it will output the certificate files that we need.
Now, I'm going to clear the screen again
and then just do a file listing, so ls.
You'll be able to see a folder called pki
and it's inside this pki folder
where all of the output files are stored.
So we have the certificate,
we have the private key, and we have the certificate chain,
and we need to upload all of those to ACM
so that it can be used by the client VPN product.
Now, to do that,
we're going to use the AWS command line tools,
and it's this command that we need to use.
So it's aws and then acm.
Inside the acm product,
we're going to import-certificate,
and then we're going to specify the certificate file,
the private-key file,
and the certificate-chain file.
Then at the end,
I'm going to use --profile iamadmin-general.
This is the named configuration profile,
which connects to the AWS account
that you're doing this demo with.
If you're following along with one of my courses,
you'll probably be using iamadmin-general.
You should use whatever named profile
that you've got configured to connect to your AWS account.
Once you've got that command sorted,
press Enter and that will upload all of the files required
into ACM and output the ARN to this certificate,
and that means that we can now use that
within the client VPN product.
Now, in my case, I'll have to press Q to exit that utility
and at this point, we've completed all of the steps
that we need to in this part of the demo series.
Now, if I just go back to the AWS console,
click in the search box, type ACM,
and then locate Certificate Manager,
right click and open that in a new tab,
what you should see is the certificate
that you've just created listed under Certificates.
If you don't see it,
make sure that you have the correct region selected
because remember, Certificate Manager is a regional product.
If you do see that here, everything's good
and that means you've completed all of the steps required
within this part of the demo series.
Go ahead and complete the video
and when you're ready,
I look forward to you joining me in the next part.