AWS Client VPN で1つのエンドポイントで複数のクライアント証明書を利用する方法

$ git clone https://github.com/OpenVPN/easy-rsa.git
$ cd easy-rsa/easyrsa3
$ ./easyrsa init-pki

$ ./easyrsa build-ca nopass
Using SSL: openssl LibreSSL 2.8.3
Generating RSA private key, 2048 bit long modulus
..........................................+++
...................................................................................................................+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Private CA

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/xxx/yyyy/easy-rsa/easyrsa3/pki/ca.crt

$ ./easyrsa build-server-full server.example.com nopass

$ ./easyrsa build-client-full client1.example.com nopass
$ ./easyrsa build-client-full client2.example.com nopass

$ cp pki/ca.crt /custom_folder/
$ cp pki/issued/server.crt /custom_folder/
$ cp pki/private/server.key /custom_folder/
$ cp pki/issued/client1.domain.tld.crt /custom_folder
$ cp pki/private/client1.domain.tld.key /custom_folder/
$ cd /custom_folder/

$ aws import-certificate --certificate file://server.example.com.crt --private-key file://server.example.com.key --certificate-chain file://ca.crt --region us-east-1

$ aws acm import-certificate --certificate file://client1.example.com.crt --private-key file://client1.example.com.key --certificate-chain file://ca.crt --region us-east-1

openssl rsa -aes256 -in client1.example.com.key -out client1.example.com.pass-ari.key
openssl rsa -aes256 -in client2.example.com.key -out client2.example.com.pass-ari.key

cert /path/client1.example.com.crt
key /path/client1.example.com.pass-ari.key

cert /path/client2.example.com.crt
key /path/client2.example.com.pass-ari.key

{
    "connection-log-type": "connection-reset",
    "connection-attempt-status": "NA",
    "connection-attempt-failure-reason": "NA",
    "connection-id": "cvpn-connection-xxxxxxxxxxxxxxxxx",
    "client-vpn-endpoint-id": "cvpn-endpoint-yyyyyyyyyyyyyyyyy",
    "transport-protocol": "udp",
    "connection-start-time": "2020-04-20 14:30:00",
    "connection-last-update-time": "2020-04-20 14:31:02",
    "client-ip": "172.22.3.2",
    "common-name": "client2.example.com",
    "device-type": "mac",
    "device-ip": "xxx.xx.xx.xx",
    "port": "23771",
    "ingress-bytes": "3051",
    "egress-bytes": "2629",
    "ingress-packets": "9",
    "egress-packets": "6",
    "connection-end-time": "2020-04-20 14:31:02",
    "connection-reset-status": "NA"
}

./easyrsa revoke client2.example.com

$ ./easyrsa gen-crl
Using SSL: openssl LibreSSL 2.8.3
Using configuration from /Users/h-matsu/Documents/code/easy-rsa/easyrsa3/pki/easy-rsa-40453.izPBCL/tmp.BwkfBg

An updated CRL has been created.
CRL file: /path/to/easy-rsa/easyrsa3/pki/crl.pem

2020-04-21 00:17:46.684079 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2020-04-21 00:17:46.684190 TLS Error: TLS handshake failed