Install Openvpn on linux with with an custom Access Server installation script

Install your flavor of linux.
This demo uses DEBIAN

After a basic install of Debian

su -
apt install sudo
apt install curl

    Add the username that you logon to the server with into the sudo file

visudo

username ALL=(ALL:ALL) ALL

nano /etc/network/interfaces

1. Add static IP configuration:

   auto IFNAME
   iface IFNAME inet static
   address 192.168.0.11
   netmask 255.255.255.0
   gateway 192.168.0.1
   dns-nameservers 8.8.8.8 8.8.4.

2. /etc/resolv.conf
nameserver 8.8.8.8

logon to your access server portal  (openvpn.org) web site

Select "My Access Servers"

Select "Add New Access Server"

Select your deployment method (in this example i clicked on the linux icon at the top)

It will provide a custom installation script
Change to root

su -

(it will look something like this)
bash <(curl -fsSL https://install.openvpn.com/as/iUqtXys1232SieW1) --yes

copy the script command and paste it into your system you installed and let the script run to completion

you'll be provide a temp password during install

Once its completed, you can ssh to the box on port 943 and complete the installation.  Use the password that the system gave during the install like the picture above

Select AGREE

Set the tunnel type you want.  We are using "NO full tunnel" so its unchecked

select continue

download the profile/app

Install the app/profile.  This is used to authenticate your system 

run the app if it doesn't start automatically.  Select Agree

it will reflect the local ip of your systme

use the temp password

System shows as active now

connect to your openvpn access server url

now that you are connected, click on the COMPLET button and your server will be added to the list.

now you want to add a SSL cert via letsyncrypt

Logon to your openvpn server instance that you installed,

click on "VPN server" on the left

then in the "SERVER ADDRESS"  

Put in the fqdn of the server that matches what the server name will be if you are going to install an certificate

Step 1: Prerequisites

• Ensure you have a domain name pointing to your OpenVPN server's public IP (e.g., vpn.example.com).

• Open port 80 (HTTP) on your server for certificate validation.

Step 2: Install Certbot

For certificate management, install Certbot:

• Ubuntu/Debian:

sudo apt update && sudo apt -y install certbot

• RHEL/CentOS:

sudo yum install epel-release

sudo yum install certbot

Step 3: Generate Certificates

Run Certbot to issue certificates for your domain:

sudo certbot certonly --standalone --preferred-challenges http -d vpn.example.com

• Replace vpn.example.com with your domain name.

• Certificates will be stored in /etc/letsencrypt/live/vpn.example.com/.

Step 4: Configure OpenVPN with Certificates

Install the generated certificates into OpenVPN Access Server:

Change vpn.example.com to be the same as your FQDN

sudo /usr/local/openvpn_as/scripts/sacli --key "cs.priv_key" --value_file "/etc/letsencrypt/live/vpn.example.com/privkey.pem" ConfigPut

sudo /usr/local/openvpn_as/scripts/sacli --key "cs.cert" --value_file "/etc/letsencrypt/live/vpn.example.com/cert.pem" ConfigPut

sudo /usr/local/openvpn_as/scripts/sacli --key "cs.ca_bundle" --value_file "/etc/letsencrypt/live/vpn.example.com/chain.pem" ConfigPut

sudo /usr/local/openvpn_as/scripts/sacli start

Step 5: Automate Certificate Renewal

Create a script for automatic renewal and apply it via cron:

• Create a renewal script:

sudo nano /usr/local/sbin/certbotrenew.sh

• Make it executable:

sudo chmod +x /usr/local/sbin/certbotrenew.sh

• Schedule it in crontab:

sudo crontab -e

look at your certificate in your GUI and should look like this: