Jump to navigation Jump to search

AMPRNet VPN is an experimental method to access the AMPRNet using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the following Certificate Authorities:

  • ARRL Logbook of the World (LoTW)

The CA validates using a relatively strong method that the operator is actually licensed, and gives the operator a certificate to prove that. Other services, such as the AMPRNet VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services.

If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the AMPRNet VPN can be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.

The VPN operator does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!

Extracting the certificate from LoTW

LoTW uses a custom file format (.TQ*) to exchange certificates, but after the LoTW certificate process is done and the TrustedQSL software has your certificates, they can be easily copied from TrustedQSL's directories. You'll need three files: your user certificate, an intermediate certificate that was used to sign it, and your private key. The only secret piece of information is the private key - you should not reveal it to anyone at any point, as they could then use services on your behalf, using your callsign.

Linux and Mac

  • ~/.tqsl/certs/user contains the user certificate
  • ~/.tqsl/certs/authorities contains an intermediate certificate
  • ~/.tqsl/keys/YOURCALL contains, within some XML, your private key

The user and intermediate certificates need to be concatenated to a single file named client.crt. That can be done by a single command:

cat ~/.tqsl/certs/user ~/.tqsl/certs/authorities > client.crt

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31


Copy-paste that block to a separate file named client.key. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.

Configuring AMPRNet VPN

Windows: OpenVPN

Linux: OpenVPN

Mac OS X: Tunnelblick

  1. Download Tunnelblick, it's free and open source, and works like a charm. It's based on OpenVPN.
  2. Download the AMPRNet VPN configuration for Tunnelblick, it's a zip file containing a directory with a couple files
  3. Double-click the downloaded zip file to extract it, you'll get a directory named amprnet-vpn.tblk
  4. Move the private key (in a file which was named client.key in the previous step) to that directory
  5. Move the certificates (in a file which was named client.crt in the previous step) to that directory
  6. Double-click the amprnet-vpn.tblk directory - this will launch Tunnelblick and install the VPN configuration

You should now see a "tunnel" icon in the top right corner of the screen. Click it to see a few menu items allowing you to connect and disconnect the VPN.