Switch from using PSK to Certificates with easy-rsa-ipsec

[dguido]

https://github.com/ValdikSS/easy-rsa-ipsec

Cheatsheet:

• ./easyrsa init-pki
• ./easyrsa build-ca nopass
• ./easyrsa gen-req dan nopass
• ./easyrsa sign-req client dan

OR

• ./easyrsa build-client-full ryan nopass
• ./easyrsa gen-crl
• ./easyrsa gen-dh

Alternatives:

• https://wiki.strongswan.org/projects/1/wiki/SimpleCA
• https://wiki.strongswan.org/projects/1/wiki/IpsecPKI

Either way, it should be as easy as possible for the administrator to enroll new users to their VPN. We should help the administrator create and sign a certificate, then generate a new mobileconfig file to provide to the user.

[jackivanov]

Certificates authentication added.

[dguido]

I think we can build the client and server certs with easy-rsa too. It does some bookkeeping on the certificates, so there is some benefit over building them by hand.

https://github.com/trailofbits/vpn/blob/master/vpn.yml#L80-L111

[jackivanov]

All certificates are building with easy-rsa.
p12 export implemented with openssl directly for flexibility

[dguido]

Oops, I missed that.

[dguido]

@gunph1ld You want the prime256v1 here I think:
https://github.com/trailofbits/vpn/blob/master/config.cfg#L8