Merge pull request #4884 from c-po/openvpn-t7738-migration

openvpn: T7738: avoid duplicate certs during 1.3 -> 1.4 migration

5 files changed, 1009 insertions, 22 deletions

diff --git a/smoketest/bin/vyos-configtest-pki b/smoketest/bin/vyos-configtest-pki
index ac6272cc4..f01f5ddbb 100755
--- a/smoketest/bin/vyos-configtest-pki
+++ b/smoketest/bin/vyos-configtest-pki
@@ -76,6 +76,389 @@ rpki_ssh_pub_key = """
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB4PJ+UMVHirITARNsmRnZllz6wk2INO9inAaxYiSO7j2UlLEd7XEp/wWHB/Iy7jRKe3XIOVGaabPgKxsuBu5kYw+9cbXV7fj4LSlJVS+kXpqpFN4uXWkNErtGeOCbey74jxJEtBHipssbpVdY4W5WnCKpsTEtpTSEVhM80/50Cs2mxYQQqyiGTqlNd2GDdXNane8IyOXYlOyENreUPunbEhJIBF4RjR+d8QCZDMfhnoMjDAZ0W4xahAiD6gUEz0BGs7b8UiNGzPoB5xH9Z5TvYkTDhomJzX9wAlADo+JAEfCS6jdaWXW1unF5FmgHY1AbbYRPIku+F9Nqig0tP0el vyos@vyos
 """
 
+### All OpenVPN related pub/priv keys generated on VyOS 1.3.8 using easyrsa
+openvpn_ca_1 = """
+-----BEGIN CERTIFICATE-----
+MIIFFDCCA/ygAwIBAgIULRXlIT+yqqWW/OCBGnOtDtxmeJowDQYJKoZIhvcNAQEL
+BQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQH
+DAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBO
+ZXR3b3JrcyBUZXN0IENBIDExFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZI
+hvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc0NDU4
+WhcNMzUxMTI5MDc0NDU4WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
+b3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAw
+HgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1S
+U0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALQHJWBuKQrFvX6pOhpk3FlJ
+aCiwDxPWib0EfMZWeF+CsvHxYH1W/WZfhVW2PcL8Zti0ppoqRsIQpyUDygtwWLjw
+MCVnQtD9yaA6rUImisQfNsR/ePrFaFK+8fSrGGS4poUnKFueNKzq4V9K7xMFb6+T
+recvoclYDEeBMOpCt3dOSCwNlKa2CboUA0mbATXMiIm9lW/1K8bJ7UwRydiEIU9e
+wi3ZCFXNw7FWj1h3cR1JwxwMPcL9jzm+jlhBTLCy7yiOkdCw7vVFBRa+OaxQ+tTv
+S+IpPv5f4/9Hr19IqmsR5HBOHJrYvgD3LDGFZZ1uuKeG4CM8N8G7K9DxqXvEl7EC
+AwEAAaOCASwwggEoMB0GA1UdDgQWBBTh+x9ektMHGHxAY/+cZMng8fuGpTCB6wYD
+VR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCBqzELMAkGA1UE
+BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYD
+VQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3Qg
+Q0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3Qt
+Y2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxmeJowDAYDVR0T
+BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBACgqIP4xZo6i
+oKnlNLhix4WRp0tRkveAKJ144ylCzzzP5+pdPQKS5hlydDcNxrJB6EYlkmaWBsvY
+t7NO9oII4wwD7uvD7Tnad31ANc9lkD8qEksoVy5Sc9HpYQvo+a8ZH/Co8ciTse/e
+UAIWzp8GHTH40HeqGtJGvLF4pHXxHYBO8vuZAL0Bs8hl7ihyOrRE5fkwjmWH3Rcs
+avTF5jhAOsRsInUiqLUafFChvte3z739irjCaIK0lt0ZWfKvWVeV+JeNgwl0mqNq
+78FZRQa7rC72x3UJJwV1xRcPp4Y+WW7Xb8gTZqkuMzBW3xgYuKlOmHOz1Ta2ktEt
+eDdS5PF/c+g=
+-----END CERTIFICATE-----
+"""
+
+openvpn_ca_2 = """
+-----BEGIN CERTIFICATE-----
+MIIFFDCCA/ygAwIBAgIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQEL
+BQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQH
+DAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBO
+ZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZI
+hvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzE5
+WhcNMzUxMTI5MDc1MzE5WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
+b3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAw
+HgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIGA1UEAwwLRWFzeS1S
+U0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxcxr7KKqKuUOWpyE/GZ2BY
+vMxXEdDavQS3Ok2n5hFAnCAqtjCx63z26P18xJdqkpWpsyTxN5aEGgXyFUIL6kic
+eL4D9vIO52swI8QaRi/4V7X86wJQqUaQYg7FMboeyBsLXFMl+TX1vkX/bgFiGSfq
+S0oTPZt68GO6jHxbE1tqqhS2qQSVt/4WJMyZ3BFjQpz0szwcVh2tHKqSSuhpS0MY
+8MKpeITo6LhPPphfpdBn6fizydj1IEdXD22YJK+YUYv2AFY5V6GzYYQpO2oGe9CG
+W68a/Q+OtocZYvjpCIm21UFnfkxz4vdW7vNgBSXvfKOEZ+ZhKzaNL6Ftj0afJdsC
+AwEAAaOCASwwggEoMB0GA1UdDgQWBBTaP0CGONZGw8I/Bze7xjO1p3dKszCB6wYD
+VR0jBIHjMIHggBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UE
+BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYD
+VQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3Qg
+Q0EgMjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3Qt
+Y2Eubm9yZXBseUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDAYDVR0T
+BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBADjhWXjaR5EZ
+oqHBD+H2F+YFg4oxf5vTr37JrsDINZG2cDprGQUl/8MrjziuVobtFzFLMlYwI+s8
+ASV1eYa+8yGrZFspsaJ3FkvWLx1CRCbP+jH+rJu+PzkcNRf5RinNxRVt/TnZlWKG
+AACsoGyzQJ3bg0NQKb47W0vD6PZ4nKK3SWvLdLBPW0bYpe62S3fE188fq4gr4Ig4
+J0Egi2aZhX/MHpT9bYGvQih+FgY33aQiGQphX1FX2n4kC7fwcJlzlp+mMhmnjWwu
+WSxRMFGAp6aJlPBvWbE3GyRx0b7skH7xmbRpV3DYbzxAxpzXw5o2xUx/tyQKW76X
+p8nKZtK7jQM=
+-----END CERTIFICATE-----
+"""
+
+openvpn_crl_1 = """
+-----BEGIN X509 CRL-----
+MIIDDzCCAfcCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYD
+VQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBO
+ZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDExFDASBgNV
+BAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlA
+dnlvcy5kZXYXDTI1MTIwMTA5MjYwOFoXDTI2MDUzMDA5MjYwOFowIzAhAhAQ70nB
+plg7b4g0yD0jTde6Fw0yNTEyMDEwOTI2MDBaoIHxMIHuMIHrBgNVHSMEgeMwgeCA
+FOH7H16S0wcYfEBj/5xkyeDx+4aloYGxpIGuMIGrMQswCQYDVQQGEwJVUzETMBEG
+A1UECAwKQ2FsaWZvcm5pYTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1Mg
+TmV0d29ya3MxIDAeBgNVBAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRQwEgYD
+VQQDDAtFYXN5LVJTQSBDQTEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5
+QHZ5b3MuZGV2ghQtFeUhP7KqpZb84IEac60O3GZ4mjANBgkqhkiG9w0BAQsFAAOC
+AQEAFVgGK+EIWsTO1d3PGeh+Sxp9etu60opYYcvtlEqZsyLOp8oJYslo62BNcrxz
+LIoRTViEVqyFjxyl2+mTk9q/REZqcSSesBpdkzErdVLixCEeIfSgmBd3yoqih2gG
+R+fEibG6ETbYAc4fzZN761F5Z7Wurm65s5Xgl4X6Vl989kskiw8C0ESeSUKciINP
+mwWbwTRvJRStJve5NtkqpM6Rdq0SoTA0XWQqRcc7Aicv3/SI5aPpEGTLFKuRoCgG
+GhnTQywaNACU/BykbjGiiFcwNWpfHrYj3lCFm2Gyw9Sw70PT1RGBDq9yBSa0Px2r
+i1WjhnYF58PjrW3m1laoI+LkIg==
+-----END X509 CRL-----
+"""
+
+openvpn_crl_2 = """
+-----BEGIN X509 CRL-----
+MIIDEDCCAfgCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYD
+VQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBO
+ZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNV
+BAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlA
+dnlvcy5kZXYXDTI1MTIwMTA5MjYzMVoXDTI2MDUzMDA5MjYzMVowJDAiAhEAir2a
+GfQlPIE/ohldfFbqRRcNMjUxMjAxMDkyNjI1WqCB8TCB7jCB6wYDVR0jBIHjMIHg
+gBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzAR
+BgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9T
+IE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIG
+A1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBs
+eUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQELBQAD
+ggEBAGgW8FkCVtFsmvnQcUuKtYEVco+xbl+DT++TTNuKneAIkqpDCtGNYG4GgV5X
+isEa443ubxaIL7uAvKu4gAixT7wegLQV4x/+vFgzrCeTlktyGUH2P+53Dta0sBn0
+A8X4onbe1dDciosMhh4cm4Rj6z8p3xom9aNq/R4hbPm0r2DZi5cfXAW3nuM/pmoi
+9I8lU5UoA7oSw2/nvSt2NDbW5XusP7SwvLL3wtn8MBpa8Y91yjFGCGsruu9MkMwv
+1KLb4v8RSDZqHmPeZP+hSPLl/CIzb1rQLEtjD9tbwigNLCVcnH1ZzveA5+B2o+q8
+QwyETyzWdV4Y7JUsCGgTNVvpyJ4=
+-----END X509 CRL-----
+"""
+
+openvpn_crypt_file = """
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+5f48386b6d3f5aa8c828d88fe5c6791f
+a7cd0a72b283e2c8c3d8d7171ce4dcd9
+3c33e06b3b99cf1868ddc90e803d2eaa
+e3278e9f9bcb937482e1b01be85a2df5
+ea1f1a83d07af10c9ae821655d332649
+37d49eedcee1b2a4f742283ebeaa7524
+5a3d0687c0122ed7d10bfeaff97885e8
+9514573cc566de8d7effbe0fff50e01e
+3d966ca8e5d5e7d756871aed46aafe4b
+1d20c8ef6df39c07198dcf957661aefa
+76e212078b7a4c2165b72929b15a1dd9
+c540e71a50718d3e7d1a70e85b29481e
+05636b9df49d2e018af79ec052dfdb99
+f26da65bae32923a00eeb6a1e764630c
+35b2a89da6092cff6cc438d4086f7679
+2a1580af158f0b25ae41034933424d36
+-----END OpenVPN Static key V1-----
+"""
+
+openvpn_dh_1 = """
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA86ThynzIp1h5XN5YcVNUg+1G4EYqF81lypzqfx6zlD9eVSm6Sa1E
+8sOtiMg1eAnz/tJYMmStJDJRnD62oxs/dgK4Imoz5clnZd0tq/ligwG1Qt54TuQ+
+tlRBvQLa9r49kBRQRCka+R0YbQSaQGkwfD3VZfFX2CKeklcOnEVF5yXkaev10cBL
+OEXYEbdGO+WPmdkY0VXr6dzRZjkATSG+BIaKJ78y6o5sIiyxjLzJFYUQm9Kx/s+n
+JZLywufeycIycieMwGDyW6jewfBmdDPNgSiaDhbDpDcd7t/Qmoj01Y+z35YTnKuf
+DCMzCfBxuV/+GM+XcbhRVFdRrgWOnnlQswIBAg==
+-----END DH PARAMETERS-----
+"""
+
+openvpn_dh_2 = """
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAle+JFVmEsawtaiX0AFEwAOhoVb6L7BY2Nh6tiVzFYiZEQoa6yMr5
+vi7ZGIv9n0gbaMtW+L6e7E4gJXPDSL15VW16UfNg1mXm05jpuZPpXBZndk2CtFvV
+ZHKzH1jnpO/E4oBjgJ2H4tVjIhPhgjk/oTc8yoQuluDnkhIcBcFqkdjS/vpAzfmA
+xGtvcYseDS6/ZZI7z9qkYRKCm6v/i2xk+zEI9IqnmowCt+n51psMdfHSYPqXFJxf
+S3ok//GvcJ7f4EEYUIVFsr+FbljlNN37FDauEgNa/eOGh9DIjsoY+EWoyhbzvw2r
+M3Ij0zoYsc99E5+MPdXlfkSe0NesBHaK8wIBAg==
+-----END DH PARAMETERS-----
+"""
+
+openvpn_hub_1_pub = """
+-----BEGIN CERTIFICATE-----
+MIIFPjCCBCagAwIBAgIQezkarqdV2mnNk8+FGw3WuTANBgkqhkiG9w0BAQsFADCB
+qzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBv
+d2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdv
+cmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0B
+CQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjAeFw0yNTEyMDEwNzQ1NDJaFw0y
+ODExMTUwNzQ1NDJaMIGtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
+YTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1MgTmV0d29ya3MxIDAeBgNV
+BAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRYwFAYDVQQDDA1vcGVudnBuLWh1
+Yi0xMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDiS7M12I5D2Y+3GSNx2oNVFBEx
+557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUGDD60p/lwB6si
+B2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/IkopZF+FdL8D5y9
+tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb1L3TZzsjwXzg
+TGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46CLoAJAk+aXpZg
+Mzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3mc7kT2RlAgMB
+AAGjggFYMIIBVDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQujCWJeWPGu1pXOZ7Y9vr6
+lWSkcTCB6wYDVR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCB
+qzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBv
+d2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdv
+cmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0B
+CQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxm
+eJowEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBgGA1UdEQQRMA+C
+DW9wZW52cG4taHViLTEwDQYJKoZIhvcNAQELBQADggEBAF/ndor0WZHcHgwSQTd9
+f4heYHMmy2CNBuodaEhFfszgT5s3Cxu3rmiTkciffzlF9P25QupW73XqZ0brKYn7
+NR/StUjzWafcJL+0HO3Mcc14sFY3S+CW2iHgDlhOlOIdkHvkCmG27oBRkp2wAOb8
+Bxc2nnV4Bn6n2DF3HYS+8YwGB1nlrkeRVIT4zBIpCofWMO4PRXFceksGxxZ1Acna
+wlLaL0lmZZFKTrueVY5JePUPqO2awxiy9uh83szZ5j6ZQKEYkVl6tMc+/fS+ZrQe
+WU7WBESg7WQ+UNFy4GdubmMEIReolEWvuUcEQlhWcLCeP4H4yvXoM21M1i/q28M7
+wZI=
+-----END CERTIFICATE-----
+"""
+
+openvpn_hub_1_priv = """
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDiS7M12I5D2Y+3
+GSNx2oNVFBEx557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUG
+DD60p/lwB6siB2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/Iko
+pZF+FdL8D5y9tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb
+1L3TZzsjwXzgTGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46C
+LoAJAk+aXpZgMzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3
+mc7kT2RlAgMBAAECggEBAM3J5YkcDBPrr2PkunT5L+GYxCJL7fimdrg8ELyMPTGu
+vYYwEmPv1zwb7Jog2x1zhxXe5vTkT4fjRkafsA59irq0Xo4tkUpaZov5GemawGNK
+an9noF7gtZVczdyu3EY/Lp1pZIErWcJI1zpdhrfQhPOwBuwFmNQbaKzAAYR4/ek3
+xkl76aLFjgf4Zo/+1VeDdmuvCXxLIc/3XEssirDGnKDPn1CSAcKKDEPX23MMHCAK
+VnjmocrgfJd3g2ST0GsWtWjO2sn5twCN7EZNClF/jYbCOTUdgGbzQFkX3apkIrMG
+FkNvxNZzo2ZtqPDZIhCvIGyoVX/bF+yTwgU2KBj2yqkCgYEA9ENeYV9oDe2Uq4TN
+63FvKkHcP1hjhj3vK0zuWmiPSUAcd+uCtpBcyfn+UP3sq5WN/TYCFOPIiFck9k2b
+m5OJzduUVJ7VvE56B/semvTkZOmHX3pVPQSNwZ5BuJ+osAqwVG1oD6nG9ewrf7eQ
+zERUbpbMT+wZdEdESvouktkhmO8CgYEA7StRPmRLYZPOzlrRwqXR0MKo/TfItOUj
+Nd1h/HD2l1XKbG7Dq+4UCI3TJnfpIa9CAKAf2MLnsAWIVObnLuStdIzoSuAw1zaz
+mxN3Ssrc5YAj1jXUALcXIqMxhg+6Wip5SnvEzpoye5w+pA19JySpXqGfa/KhlcDY
+W7ixcTmeD+sCgYEAvxmJ2HJ1DRiHzNzc4cvgZdYbAzAaxSblXCIXBIJzP6K54xRN
+MpmlDpvYXPMcW21pJeZAIKnI9OoAz/YNvNzj3jthRAb0PxvCm0XbPu5DVbPipk8m
+KtPKN+Whk1jN99SU+aiS1lZEg5gevBAYZ8c5qz+tXwXfMDqlcmdjUp4vi98CgYAM
+0WiErLr+PRTSRkpL8NZUKBEmDlvEmxW6FYr0L87EAxj7n0joA+gFRlUBIT3yWhyB
+GCZgerg25TWnEQuxlx5gzDTJxzAckZJHcVfjLO+fX7uQGjypBTw03QkSK8twkBca
+FXJfkCnmUF16VFhNQ0f8G1QYa3acN136JxNAAVMvnQKBgQDodAp0BcUFcfeEHtK5
+FzGJ57m4cXk4wMf0QcChCrxJwS5AIdAf4pjqKgjAd5OOqUJzcwPf8TEMWJRbUAOd
+mnvB3fsLQaJMdq9y/h+GremZIdkXnM0SjmJfBnF9OOhCii3tR/xXVDj71JChkoeM
+vQ1ROCMubFrRl2Kkt6i7sOq/UQ==
+-----END PRIVATE KEY-----
+"""
+
+openvpn_hub_2_pub = """
+-----BEGIN CERTIFICATE-----
+MIIFPzCCBCegAwIBAgIRAN9Hxz6M0Vkcc+MHyj5ojKEwDQYJKoZIhvcNAQELBQAw
+gasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQ
+b3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3
+b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcN
+AQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzQzWhcN
+MjgxMTE1MDc1MzQzWjCBrTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3Ju
+aWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYD
+VQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEWMBQGA1UEAwwNb3BlbnZwbi1o
+dWItMjEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5QHZ5b3MuZGV2MIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAphlrcl3zMmzYQfVnlRTg66rJ
+Uxx3bSwHkL66ZrUN8eScLSnW0Qz4s1PluZhvOKMf9v0sOEEXPouAf9UzAhQztYlU
+6yc10F0CWKwjeNGVSDSLf6Uyc1Y2sYWXLQTIUg5t0wNaT9zBUH6Nzgocb5nrMYOV
+6nvkdm/MrT+AxzJwow+l/if780anFgCXZNsmwt0Qxai1BAgQbIjSOyfXbhhzd7lP
+cbdlXB3loW6f1JQc9pNbR0ZPj2vEFv1lHzya54cbNWQ510yGBqSi1YK4o8sxCNca
+8nltH8skkkqugtG8hmk3Lzc3IxCiyXVSvTszsS5hQtQT+xioEKmh05yo4mIFbQID
+AQABo4IBWDCCAVQwCQYDVR0TBAIwADAdBgNVHQ4EFgQUgp3Kp12Gk0cvFlUnzsRL
+tv5qdOswgesGA1UdIwSB4zCB4IAU2j9AhjjWRsPCPwc3u8Yztad3SrOhgbGkga4w
+gasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQ
+b3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3
+b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcN
+AQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXaCFAijgBEuPeYa4FxzJdCEG9Z5
+HFrBMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAYBgNVHREEETAP
+gg1vcGVudnBuLWh1Yi0yMA0GCSqGSIb3DQEBCwUAA4IBAQC8flK1UfwCtj79Jv5/
+z/vyIwsNObTxQHag2eZmlJyMeX40T51uuSIifxPKqmyNk+7lk3nuqJkrRxFc63WV
+wo2IIAVQmOz0D3zm2A/21Cree/wqyXpl4H05qfZ4J9NULFCNswQEUSSje9WpEp5v
+ti5Qa88hFMzGS6C23FDL9A0LBeY9lsEieyVkEB3CRXHlkX/Mttg9DjbGRxjQX+VF
+W3DLlHZjuONSs3nRKypHMRVNP0SqTtG4TQv5BqArDyJHon/N/mepwNR0zDT3ksUo
+3WW3uGI9CGcZoVCAPo0+LrjaBUvJVPwG1kqr++bKndozLuy/68hit8cuEcc2Np43
+Nqqd
+-----END CERTIFICATE-----
+"""
+
+openvpn_hub_2_priv = """
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmGWtyXfMybNhB
+9WeVFODrqslTHHdtLAeQvrpmtQ3x5JwtKdbRDPizU+W5mG84ox/2/Sw4QRc+i4B/
+1TMCFDO1iVTrJzXQXQJYrCN40ZVINIt/pTJzVjaxhZctBMhSDm3TA1pP3MFQfo3O
+Chxvmesxg5Xqe+R2b8ytP4DHMnCjD6X+J/vzRqcWAJdk2ybC3RDFqLUECBBsiNI7
+J9duGHN3uU9xt2VcHeWhbp/UlBz2k1tHRk+Pa8QW/WUfPJrnhxs1ZDnXTIYGpKLV
+grijyzEI1xryeW0fyySSSq6C0byGaTcvNzcjEKLJdVK9OzOxLmFC1BP7GKgQqaHT
+nKjiYgVtAgMBAAECggEAFmWVFG3Qrjr5CiPSHMsc7QoxbXCINgNa3cyqC9FcGQLv
+gDOFENlD68JjVpxUWvm8BKzsuoUkYj2jTRltcFlTA6aJ+c9mtTrlZxmHCvKPw5W6
+PbMD04OLinJuCRb8//uMGYj5M42bz4PREThRz0ac7SdGHsEn9ERs/+txLOsDPylU
+ZL4NrpYYespz45/AzgYflxk476l0IJhtLTY5N3XuJ7aonVZttDNA9Ds9W329spOE
+hvQKVKtmzMEddTAPRuk15lq+qM8qdZb+h/cmx72zCegsuKNXrMhvemcZdOqjqZGC
+li0p2hQawtKFzLhQUEYglUb/4lIB0Aihu84OHDchDQKBgQDSKUjW827NRQ6mysOB
+a7SZBreSklkXArfLc/4nasQcdeoFGO6xHGo6MR78LHuuTC2O/MDeMZ0A5PAhB5Tr
+WxVa9FSbbLk8Ytkm9VTZjdtaVDID0RuV7fcSgvpG+msrcC238uMo2rAtE7mNWJK4
+COxy6vlAygt3SwXNVjh9GEBFQwKBgQDKU9v5f4uhlydW1Oj21kbPQU7vfaLt4dkz
+znOTSOizqRyZdihNCuvdgyKphCRVR4x/bCNQ9VpScXe4p8LnOmPDr2K7FGW2It6D
+WdRkqlTrFROtG9xPh1eNwzl3B+QSt7OC8+muL2gcv3V5V55mm9EojzKnlXYrs4V6
+Jsef3GeHjwKBgF9+eOWLGZbWQTESw0FEgnxiK/nC3A5zorYkz6BziAbyoVKNoLAD
+nFUyysSFJfHuFWl6edy8qH2miWJIwqcq7Qo2KVeyUH0a4VctdM+iAMELrupDEwjO
+Z00XDMhBs366a1vBVuzSaekhpFeQnqJXE7GoCXgiFpGvGkTSX7qf0VxnAoGBAIjk
+BiAfuKRi9X3dXaWsQop1gGevFG5ocSGJHE9ZdAAiejQmaov9yKm90NTqj/6XAysv
+ShG7fxnqpXrtHoR90AQVBPLYkRyTKQOr4nUdfYj0YLSt9fhk9Mr4fEfZseksGyuN
+xdxRPNq+e0fXDVgVMoWDpV0XVbWpp7SGymeRowZnAoGBAJXAgnKIVch/fXdoIjWF
+ShPkZLa+784TTtg8XdYyyC/IEdgvWgNAZ71YBlIpupcORQwKFHR8wrQYj69f8U9c
+pkFIqB20DQr2ZG7fxLA6kCwcCt33Qx5dC0pTvKROHUyO5riuL0UOTYDmHkwNBUC+
+Gmcr5OJhN9KqJaAXkyekr3Xc
+-----END PRIVATE KEY-----
+"""
+
+openvpn_shared_secret_1 = """
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+44a5889380ec775d952d94071f719bc1
+282e4156c9e778895892302dcfafc233
+e0d881e38393c033ab3067493dfbe234
+4c58b3c22e1ae103b12a68c00df64ca7
+2d30e49f2b19c0ac764120ede85af5a1
+f9ade1752530ee7bafbf8512540d0379
+75042d485a3661c0c70f292436bcdd9a
+f410ce0b487ee2d717317414b659fe9d
+8ba892eec8c7e7816110461784a40b91
+8d98254e7a84cd06925124887bbf6a07
+cc4eba384063a4dfb890ce0b76a56f55
+df0dc4162f653c60858c3810d01071c8
+22cac29e77840f0dad62776202073350
+3d7c2cb9818096ed7b16f43cafd3963f
+ac2b95a20540ed2f4e5d46298e107baa
+0b3bdd0453edc82acbbb61eff4e43242
+-----END OpenVPN Static key V1-----
+"""
+
+openvpn_shared_secret_2 = """
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+25f54b2c5bfc25adcd54c2107ded69fc
+f79fdfb80dc95272a3591ac0cf298738
+4beda01f91a4a6bbc8dd3123356f3d4a
+e53a68e6fced4542066c257f8a45e754
+16edee612e81dc723042e248ed408245
+d67d15434a98df50caa039476868f7d5
+23088f11dcef832abb037999102abdeb
+d1454daa4dcc58f7fa6279ea1d8c7f2f
+9c9fc1e155238b1a3fb011b2ef0c096a
+fa268b08dbaf88f8a887240568118047
+25857423a5b634e7859596075fdbd809
+657bcbc912535c55d6dcda4043336bed
+d6cb91560a0d15f38983a498e3085a9e
+fe4c82ebe9003161619a475f16355127
+a14824a1e66b8327bd7e8d6e7882b3ec
+89b5fd1f3008ff9f79569f0d368cfb3d
+-----END OpenVPN Static key V1-----
+"""
+
+openvpn_tls_auth_1 = """
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+5c4fea2d9db3314af54aab7dfcf9b50c
+b540a015bf67aa1000e03fad65e78566
+4fef8910c7c219a7568c77e1b51eebe3
+8dd794e7d3718298ad1aceb02740949a
+65a22283df2962e1c61abee62ee9107d
+8572ee8e9bc15a43cda9647386c32f36
+0002e1c3835fef4a1cb9439f8e56e93d
+2808102d57d2709ba2302a2b9f1ab5fe
+684edf584fb010e6cae580df30466355
+3b662fb91dba47e8573870ab52511e99
+e59c42bce8631dfb9200fb37652efd15
+8e656b9ed4b9b4f3e73ce8e8f918e194
+02b80f6b5a36239bb6a3ca6f8b09e0cb
+9620126d171659161615790bbf441a54
+4911724f1b08e7d6d327cd87eeb0edfa
+5a2cbdd8a2e07bde2251d65b6f609439
+-----END OpenVPN Static key V1-----
+"""
+
+openvpn_tls_auth_2 = """
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+9d530ed1da7696eb75afa37520adeecb
+510e3e7506ce5d73d30eaffd6b2abc52
+7f1ccf20ae28e0834490d5fb4ef34b06
+979707bc0dc1950d66e051a2c5232062
+0465e879c3278af05ba892be9c5a320a
+1bba19b46eff1fd13a61699d9ec5b677
+5d3ce3f3ba141885ee0276f2a8d54550
+4eddd028762c4343258fa5ba9722b0d8
+0a06571d4f6a20527ddfb63d40e58821
+2158ed154d0a244e238274426369b256
+d6ac7c2161a2931f2e4afad77df7aa3f
+84e3728c5794fa18bb592647db77d1eb
+4d3a91127f3f91dcff527a5995b3f3c7
+1cc745f27aa69659472ef337f6b4432b
+01792a720b9722da5bf5d9d2a6e8601f
+191750d6c331be9049240f1a292b370e
+-----END OpenVPN Static key V1-----
+"""
+
 def create_cert(subject, cert_path, key_path, sign_by=None, sign_by_key=None, ca=False, sub_ca=False):
     priv_key = create_private_key('rsa', 2048)
     cert_req = create_certificate_request(subject, priv_key)
@@ -137,3 +520,20 @@ if __name__ == '__main__':
     write_file('/config/id_rsa', rpki_ssh_priv_key.strip())
     write_file('/config/id_rsa.pub', rpki_ssh_pub_key.strip())
     write_file('/config/known-hosts-file', '')
+
+    # Testcases for improved config migrator T7738
+    write_file('/config/auth/openvpn/ca-1.crt', openvpn_ca_1)
+    write_file('/config/auth/openvpn/ca-2.crt', openvpn_ca_2)
+    write_file('/config/auth/openvpn/crl-1.pem', openvpn_crl_1)
+    write_file('/config/auth/openvpn/crl-2.pem', openvpn_crl_2)
+    write_file('/config/auth/openvpn/crypt-file.key', openvpn_crypt_file)
+    write_file('/config/auth/openvpn/dh-1.pem', openvpn_dh_1)
+    write_file('/config/auth/openvpn/dh-2.pem', openvpn_dh_2)
+    write_file('/config/auth/openvpn/openvpn-hub-1.crt', openvpn_hub_1_pub)
+    write_file('/config/auth/openvpn/openvpn-hub-1.key', openvpn_hub_1_priv)
+    write_file('/config/auth/openvpn/openvpn-hub-2.crt', openvpn_hub_2_pub)
+    write_file('/config/auth/openvpn/openvpn-hub-2.key', openvpn_hub_2_priv)
+    write_file('/config/auth/openvpn/shared-secret-1.key', openvpn_shared_secret_1)
+    write_file('/config/auth/openvpn/shared-secret-2.key', openvpn_shared_secret_2)
+    write_file('/config/auth/openvpn/tls-auth-1.key', openvpn_tls_auth_1)
+    write_file('/config/auth/openvpn/tls-auth-2.key', openvpn_tls_auth_2)
diff --git a/smoketest/config-tests/dialup-router-medium-vpn b/smoketest/config-tests/dialup-router-medium-vpn
index 92d2f00ef..87b35b18c 100644
--- a/smoketest/config-tests/dialup-router-medium-vpn
+++ b/smoketest/config-tests/dialup-router-medium-vpn
@@ -69,9 +69,9 @@ set interfaces openvpn vtun1 persistent-tunnel
 set interfaces openvpn vtun1 protocol 'udp'
 set interfaces openvpn vtun1 remote-host '01.foo.com'
 set interfaces openvpn vtun1 remote-port '1194'
-set interfaces openvpn vtun1 tls auth-key 'openvpn_vtun1_auth'
-set interfaces openvpn vtun1 tls ca-certificate 'openvpn_vtun1_1'
-set interfaces openvpn vtun1 tls ca-certificate 'openvpn_vtun1_2'
+set interfaces openvpn vtun1 tls auth-key 'openvpn_vtun0_auth'
+set interfaces openvpn vtun1 tls ca-certificate 'openvpn_vtun0_1'
+set interfaces openvpn vtun1 tls ca-certificate 'openvpn_vtun0_2'
 set interfaces openvpn vtun2 authentication password 'vyos2'
 set interfaces openvpn vtun2 authentication username 'vyos2'
 set interfaces openvpn vtun2 disable
@@ -96,8 +96,8 @@ set interfaces openvpn vtun2 remote-host '01.myvpn.com'
 set interfaces openvpn vtun2 remote-host '02.myvpn.com'
 set interfaces openvpn vtun2 remote-host '03.myvpn.com'
 set interfaces openvpn vtun2 remote-port '1194'
-set interfaces openvpn vtun2 tls auth-key 'openvpn_vtun2_auth'
-set interfaces openvpn vtun2 tls ca-certificate 'openvpn_vtun2_1'
+set interfaces openvpn vtun2 tls auth-key 'openvpn_vtun0_auth'
+set interfaces openvpn vtun2 tls ca-certificate 'openvpn_vtun0_2'
 set interfaces pppoe pppoe0 authentication password 'password'
 set interfaces pppoe pppoe0 authentication username 'vyos'
 set interfaces pppoe pppoe0 mtu '1400'
diff --git a/smoketest/config-tests/vpn-openvpn b/smoketest/config-tests/vpn-openvpn
new file mode 100644
index 000000000..55b1aa879
--- /dev/null
+++ b/smoketest/config-tests/vpn-openvpn
@@ -0,0 +1,149 @@
+set interfaces dummy dum0 address '172.18.254.203/32'
+set interfaces ethernet eth0 vif 10 address '172.16.33.203/24'
+set interfaces ethernet eth0 vif 203 address '172.18.203.10/24'
+set interfaces openvpn vtun10 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun10 hash 'sha1'
+set interfaces openvpn vtun10 local-port '10010'
+set interfaces openvpn vtun10 mode 'server'
+set interfaces openvpn vtun10 persistent-tunnel
+set interfaces openvpn vtun10 server subnet '100.64.10.0/24'
+set interfaces openvpn vtun10 tls auth-key 'openvpn_vtun10_auth'
+set interfaces openvpn vtun10 tls ca-certificate 'openvpn_vtun10_1'
+set interfaces openvpn vtun10 tls certificate 'openvpn_vtun10'
+set interfaces openvpn vtun10 tls dh-params 'openvpn_vtun10'
+set interfaces openvpn vtun11 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun11 hash 'sha1'
+set interfaces openvpn vtun11 local-port '10011'
+set interfaces openvpn vtun11 mode 'server'
+set interfaces openvpn vtun11 persistent-tunnel
+set interfaces openvpn vtun11 server subnet '100.64.11.0/24'
+set interfaces openvpn vtun11 tls auth-key 'openvpn_vtun10_auth'
+set interfaces openvpn vtun11 tls ca-certificate 'openvpn_vtun10_1'
+set interfaces openvpn vtun11 tls certificate 'openvpn_vtun10'
+set interfaces openvpn vtun11 tls dh-params 'openvpn_vtun10'
+set interfaces openvpn vtun12 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun12 hash 'sha1'
+set interfaces openvpn vtun12 local-port '10012'
+set interfaces openvpn vtun12 mode 'server'
+set interfaces openvpn vtun12 persistent-tunnel
+set interfaces openvpn vtun12 server subnet '100.64.12.0/24'
+set interfaces openvpn vtun12 tls ca-certificate 'openvpn_vtun10_1'
+set interfaces openvpn vtun12 tls certificate 'openvpn_vtun10'
+set interfaces openvpn vtun12 tls crypt-key 'openvpn_vtun12_crypt'
+set interfaces openvpn vtun12 tls dh-params 'openvpn_vtun10'
+set interfaces openvpn vtun20 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun20 hash 'sha1'
+set interfaces openvpn vtun20 local-port '10020'
+set interfaces openvpn vtun20 mode 'server'
+set interfaces openvpn vtun20 persistent-tunnel
+set interfaces openvpn vtun20 server subnet '100.64.20.0/24'
+set interfaces openvpn vtun20 tls auth-key 'openvpn_vtun20_auth'
+set interfaces openvpn vtun20 tls ca-certificate 'openvpn_vtun20_1'
+set interfaces openvpn vtun20 tls certificate 'openvpn_vtun20'
+set interfaces openvpn vtun20 tls dh-params 'openvpn_vtun20'
+set interfaces openvpn vtun21 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun21 hash 'sha1'
+set interfaces openvpn vtun21 local-port '10021'
+set interfaces openvpn vtun21 mode 'server'
+set interfaces openvpn vtun21 persistent-tunnel
+set interfaces openvpn vtun21 server subnet '100.64.21.0/24'
+set interfaces openvpn vtun21 tls auth-key 'openvpn_vtun20_auth'
+set interfaces openvpn vtun21 tls ca-certificate 'openvpn_vtun20_1'
+set interfaces openvpn vtun21 tls certificate 'openvpn_vtun20'
+set interfaces openvpn vtun21 tls dh-params 'openvpn_vtun20'
+set interfaces openvpn vtun22 encryption data-ciphers 'aes128gcm'
+set interfaces openvpn vtun22 hash 'sha1'
+set interfaces openvpn vtun22 local-port '10022'
+set interfaces openvpn vtun22 mode 'server'
+set interfaces openvpn vtun22 persistent-tunnel
+set interfaces openvpn vtun22 server subnet '100.64.22.0/24'
+set interfaces openvpn vtun22 tls ca-certificate 'openvpn_vtun20_1'
+set interfaces openvpn vtun22 tls certificate 'openvpn_vtun20'
+set interfaces openvpn vtun22 tls crypt-key 'openvpn_vtun12_crypt'
+set interfaces openvpn vtun22 tls dh-params 'openvpn_vtun20'
+set interfaces openvpn vtun30 local-address 100.64.30.0 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun30 local-port '10030'
+set interfaces openvpn vtun30 mode 'site-to-site'
+set interfaces openvpn vtun30 remote-address '192.0.2.0'
+set interfaces openvpn vtun30 shared-secret-key 'openvpn_vtun30_shared'
+set interfaces openvpn vtun31 local-address 100.64.30.2 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun31 local-port '10031'
+set interfaces openvpn vtun31 mode 'site-to-site'
+set interfaces openvpn vtun31 remote-address '192.0.2.1'
+set interfaces openvpn vtun31 shared-secret-key 'openvpn_vtun30_shared'
+set interfaces openvpn vtun32 local-address 100.64.30.4 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun32 local-port '10032'
+set interfaces openvpn vtun32 mode 'site-to-site'
+set interfaces openvpn vtun32 remote-address '192.0.2.2'
+set interfaces openvpn vtun32 shared-secret-key 'openvpn_vtun30_shared'
+set interfaces openvpn vtun40 local-address 100.64.40.0 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun40 local-port '10040'
+set interfaces openvpn vtun40 mode 'site-to-site'
+set interfaces openvpn vtun40 remote-address '192.0.2.3'
+set interfaces openvpn vtun40 shared-secret-key 'openvpn_vtun40_shared'
+set interfaces openvpn vtun41 local-address 100.64.40.2 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun41 local-port '10041'
+set interfaces openvpn vtun41 mode 'site-to-site'
+set interfaces openvpn vtun41 remote-address '192.0.2.4'
+set interfaces openvpn vtun41 shared-secret-key 'openvpn_vtun40_shared'
+set interfaces openvpn vtun42 local-address 100.64.40.4 subnet-mask '255.255.255.254'
+set interfaces openvpn vtun42 local-port '10042'
+set interfaces openvpn vtun42 mode 'site-to-site'
+set interfaces openvpn vtun42 remote-address '192.0.2.5'
+set interfaces openvpn vtun42 shared-secret-key 'openvpn_vtun40_shared'
+set pki ca openvpn_vtun10_1 certificate 'MIIFFDCCA/ygAwIBAgIULRXlIT+yqqWW/OCBGnOtDtxmeJowDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDExFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc0NDU4WhcNMzUxMTI5MDc0NDU4WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALQHJWBuKQrFvX6pOhpk3FlJaCiwDxPWib0EfMZWeF+CsvHxYH1W/WZfhVW2PcL8Zti0ppoqRsIQpyUDygtwWLjwMCVnQtD9yaA6rUImisQfNsR/ePrFaFK+8fSrGGS4poUnKFueNKzq4V9K7xMFb6+TrecvoclYDEeBMOpCt3dOSCwNlKa2CboUA0mbATXMiIm9lW/1K8bJ7UwRydiEIU9ewi3ZCFXNw7FWj1h3cR1JwxwMPcL9jzm+jlhBTLCy7yiOkdCw7vVFBRa+OaxQ+tTvS+IpPv5f4/9Hr19IqmsR5HBOHJrYvgD3LDGFZZ1uuKeG4CM8N8G7K9DxqXvEl7ECAwEAAaOCASwwggEoMB0GA1UdDgQWBBTh+x9ektMHGHxAY/+cZMng8fuGpTCB6wYDVR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxmeJowDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBACgqIP4xZo6ioKnlNLhix4WRp0tRkveAKJ144ylCzzzP5+pdPQKS5hlydDcNxrJB6EYlkmaWBsvYt7NO9oII4wwD7uvD7Tnad31ANc9lkD8qEksoVy5Sc9HpYQvo+a8ZH/Co8ciTse/eUAIWzp8GHTH40HeqGtJGvLF4pHXxHYBO8vuZAL0Bs8hl7ihyOrRE5fkwjmWH3RcsavTF5jhAOsRsInUiqLUafFChvte3z739irjCaIK0lt0ZWfKvWVeV+JeNgwl0mqNq78FZRQa7rC72x3UJJwV1xRcPp4Y+WW7Xb8gTZqkuMzBW3xgYuKlOmHOz1Ta2ktEteDdS5PF/c+g='
+set pki ca openvpn_vtun10_1 crl 'MIIDDzCCAfcCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDExFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYXDTI1MTIwMTA5MjYwOFoXDTI2MDUzMDA5MjYwOFowIzAhAhAQ70nBplg7b4g0yD0jTde6Fw0yNTEyMDEwOTI2MDBaoIHxMIHuMIHrBgNVHSMEgeMwgeCAFOH7H16S0wcYfEBj/5xkyeDx+4aloYGxpIGuMIGrMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1MgTmV0d29ya3MxIDAeBgNVBAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5QHZ5b3MuZGV2ghQtFeUhP7KqpZb84IEac60O3GZ4mjANBgkqhkiG9w0BAQsFAAOCAQEAFVgGK+EIWsTO1d3PGeh+Sxp9etu60opYYcvtlEqZsyLOp8oJYslo62BNcrxzLIoRTViEVqyFjxyl2+mTk9q/REZqcSSesBpdkzErdVLixCEeIfSgmBd3yoqih2gGR+fEibG6ETbYAc4fzZN761F5Z7Wurm65s5Xgl4X6Vl989kskiw8C0ESeSUKciINPmwWbwTRvJRStJve5NtkqpM6Rdq0SoTA0XWQqRcc7Aicv3/SI5aPpEGTLFKuRoCgGGhnTQywaNACU/BykbjGiiFcwNWpfHrYj3lCFm2Gyw9Sw70PT1RGBDq9yBSa0Px2ri1WjhnYF58PjrW3m1laoI+LkIg=='
+set pki ca openvpn_vtun20_1 certificate 'MIIFFDCCA/ygAwIBAgIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzE5WhcNMzUxMTI5MDc1MzE5WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxcxr7KKqKuUOWpyE/GZ2BYvMxXEdDavQS3Ok2n5hFAnCAqtjCx63z26P18xJdqkpWpsyTxN5aEGgXyFUIL6kiceL4D9vIO52swI8QaRi/4V7X86wJQqUaQYg7FMboeyBsLXFMl+TX1vkX/bgFiGSfqS0oTPZt68GO6jHxbE1tqqhS2qQSVt/4WJMyZ3BFjQpz0szwcVh2tHKqSSuhpS0MY8MKpeITo6LhPPphfpdBn6fizydj1IEdXD22YJK+YUYv2AFY5V6GzYYQpO2oGe9CGW68a/Q+OtocZYvjpCIm21UFnfkxz4vdW7vNgBSXvfKOEZ+ZhKzaNL6Ftj0afJdsCAwEAAaOCASwwggEoMB0GA1UdDgQWBBTaP0CGONZGw8I/Bze7xjO1p3dKszCB6wYDVR0jBIHjMIHggBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBADjhWXjaR5EZoqHBD+H2F+YFg4oxf5vTr37JrsDINZG2cDprGQUl/8MrjziuVobtFzFLMlYwI+s8ASV1eYa+8yGrZFspsaJ3FkvWLx1CRCbP+jH+rJu+PzkcNRf5RinNxRVt/TnZlWKGAACsoGyzQJ3bg0NQKb47W0vD6PZ4nKK3SWvLdLBPW0bYpe62S3fE188fq4gr4Ig4J0Egi2aZhX/MHpT9bYGvQih+FgY33aQiGQphX1FX2n4kC7fwcJlzlp+mMhmnjWwuWSxRMFGAp6aJlPBvWbE3GyRx0b7skH7xmbRpV3DYbzxAxpzXw5o2xUx/tyQKW76Xp8nKZtK7jQM='
+set pki ca openvpn_vtun20_1 crl 'MIIDEDCCAfgCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYXDTI1MTIwMTA5MjYzMVoXDTI2MDUzMDA5MjYzMVowJDAiAhEAir2aGfQlPIE/ohldfFbqRRcNMjUxMjAxMDkyNjI1WqCB8TCB7jCB6wYDVR0jBIHjMIHggBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQELBQADggEBAGgW8FkCVtFsmvnQcUuKtYEVco+xbl+DT++TTNuKneAIkqpDCtGNYG4GgV5XisEa443ubxaIL7uAvKu4gAixT7wegLQV4x/+vFgzrCeTlktyGUH2P+53Dta0sBn0A8X4onbe1dDciosMhh4cm4Rj6z8p3xom9aNq/R4hbPm0r2DZi5cfXAW3nuM/pmoi9I8lU5UoA7oSw2/nvSt2NDbW5XusP7SwvLL3wtn8MBpa8Y91yjFGCGsruu9MkMwv1KLb4v8RSDZqHmPeZP+hSPLl/CIzb1rQLEtjD9tbwigNLCVcnH1ZzveA5+B2o+q8QwyETyzWdV4Y7JUsCGgTNVvpyJ4='
+set pki certificate openvpn_vtun10 certificate 'MIIFPjCCBCagAwIBAgIQezkarqdV2mnNk8+FGw3WuTANBgkqhkiG9w0BAQsFADCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjAeFw0yNTEyMDEwNzQ1NDJaFw0yODExMTUwNzQ1NDJaMIGtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1MgTmV0d29ya3MxIDAeBgNVBAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRYwFAYDVQQDDA1vcGVudnBuLWh1Yi0xMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDiS7M12I5D2Y+3GSNx2oNVFBEx557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUGDD60p/lwB6siB2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/IkopZF+FdL8D5y9tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb1L3TZzsjwXzgTGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46CLoAJAk+aXpZgMzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3mc7kT2RlAgMBAAGjggFYMIIBVDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQujCWJeWPGu1pXOZ7Y9vr6lWSkcTCB6wYDVR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxmeJowEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBgGA1UdEQQRMA+CDW9wZW52cG4taHViLTEwDQYJKoZIhvcNAQELBQADggEBAF/ndor0WZHcHgwSQTd9f4heYHMmy2CNBuodaEhFfszgT5s3Cxu3rmiTkciffzlF9P25QupW73XqZ0brKYn7NR/StUjzWafcJL+0HO3Mcc14sFY3S+CW2iHgDlhOlOIdkHvkCmG27oBRkp2wAOb8Bxc2nnV4Bn6n2DF3HYS+8YwGB1nlrkeRVIT4zBIpCofWMO4PRXFceksGxxZ1AcnawlLaL0lmZZFKTrueVY5JePUPqO2awxiy9uh83szZ5j6ZQKEYkVl6tMc+/fS+ZrQeWU7WBESg7WQ+UNFy4GdubmMEIReolEWvuUcEQlhWcLCeP4H4yvXoM21M1i/q28M7wZI='
+set pki certificate openvpn_vtun10 private key 'MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDiS7M12I5D2Y+3GSNx2oNVFBEx557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUGDD60p/lwB6siB2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/IkopZF+FdL8D5y9tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb1L3TZzsjwXzgTGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46CLoAJAk+aXpZgMzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3mc7kT2RlAgMBAAECggEBAM3J5YkcDBPrr2PkunT5L+GYxCJL7fimdrg8ELyMPTGuvYYwEmPv1zwb7Jog2x1zhxXe5vTkT4fjRkafsA59irq0Xo4tkUpaZov5GemawGNKan9noF7gtZVczdyu3EY/Lp1pZIErWcJI1zpdhrfQhPOwBuwFmNQbaKzAAYR4/ek3xkl76aLFjgf4Zo/+1VeDdmuvCXxLIc/3XEssirDGnKDPn1CSAcKKDEPX23MMHCAKVnjmocrgfJd3g2ST0GsWtWjO2sn5twCN7EZNClF/jYbCOTUdgGbzQFkX3apkIrMGFkNvxNZzo2ZtqPDZIhCvIGyoVX/bF+yTwgU2KBj2yqkCgYEA9ENeYV9oDe2Uq4TN63FvKkHcP1hjhj3vK0zuWmiPSUAcd+uCtpBcyfn+UP3sq5WN/TYCFOPIiFck9k2bm5OJzduUVJ7VvE56B/semvTkZOmHX3pVPQSNwZ5BuJ+osAqwVG1oD6nG9ewrf7eQzERUbpbMT+wZdEdESvouktkhmO8CgYEA7StRPmRLYZPOzlrRwqXR0MKo/TfItOUjNd1h/HD2l1XKbG7Dq+4UCI3TJnfpIa9CAKAf2MLnsAWIVObnLuStdIzoSuAw1zazmxN3Ssrc5YAj1jXUALcXIqMxhg+6Wip5SnvEzpoye5w+pA19JySpXqGfa/KhlcDYW7ixcTmeD+sCgYEAvxmJ2HJ1DRiHzNzc4cvgZdYbAzAaxSblXCIXBIJzP6K54xRNMpmlDpvYXPMcW21pJeZAIKnI9OoAz/YNvNzj3jthRAb0PxvCm0XbPu5DVbPipk8mKtPKN+Whk1jN99SU+aiS1lZEg5gevBAYZ8c5qz+tXwXfMDqlcmdjUp4vi98CgYAM0WiErLr+PRTSRkpL8NZUKBEmDlvEmxW6FYr0L87EAxj7n0joA+gFRlUBIT3yWhyBGCZgerg25TWnEQuxlx5gzDTJxzAckZJHcVfjLO+fX7uQGjypBTw03QkSK8twkBcaFXJfkCnmUF16VFhNQ0f8G1QYa3acN136JxNAAVMvnQKBgQDodAp0BcUFcfeEHtK5FzGJ57m4cXk4wMf0QcChCrxJwS5AIdAf4pjqKgjAd5OOqUJzcwPf8TEMWJRbUAOdmnvB3fsLQaJMdq9y/h+GremZIdkXnM0SjmJfBnF9OOhCii3tR/xXVDj71JChkoeMvQ1ROCMubFrRl2Kkt6i7sOq/UQ=='
+set pki certificate openvpn_vtun20 certificate 'MIIFPzCCBCegAwIBAgIRAN9Hxz6M0Vkcc+MHyj5ojKEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzQzWhcNMjgxMTE1MDc1MzQzWjCBrTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEWMBQGA1UEAwwNb3BlbnZwbi1odWItMjEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5QHZ5b3MuZGV2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAphlrcl3zMmzYQfVnlRTg66rJUxx3bSwHkL66ZrUN8eScLSnW0Qz4s1PluZhvOKMf9v0sOEEXPouAf9UzAhQztYlU6yc10F0CWKwjeNGVSDSLf6Uyc1Y2sYWXLQTIUg5t0wNaT9zBUH6Nzgocb5nrMYOV6nvkdm/MrT+AxzJwow+l/if780anFgCXZNsmwt0Qxai1BAgQbIjSOyfXbhhzd7lPcbdlXB3loW6f1JQc9pNbR0ZPj2vEFv1lHzya54cbNWQ510yGBqSi1YK4o8sxCNca8nltH8skkkqugtG8hmk3Lzc3IxCiyXVSvTszsS5hQtQT+xioEKmh05yo4mIFbQIDAQABo4IBWDCCAVQwCQYDVR0TBAIwADAdBgNVHQ4EFgQUgp3Kp12Gk0cvFlUnzsRLtv5qdOswgesGA1UdIwSB4zCB4IAU2j9AhjjWRsPCPwc3u8Yztad3SrOhgbGkga4wgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXaCFAijgBEuPeYa4FxzJdCEG9Z5HFrBMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAYBgNVHREEETAPgg1vcGVudnBuLWh1Yi0yMA0GCSqGSIb3DQEBCwUAA4IBAQC8flK1UfwCtj79Jv5/z/vyIwsNObTxQHag2eZmlJyMeX40T51uuSIifxPKqmyNk+7lk3nuqJkrRxFc63WVwo2IIAVQmOz0D3zm2A/21Cree/wqyXpl4H05qfZ4J9NULFCNswQEUSSje9WpEp5vti5Qa88hFMzGS6C23FDL9A0LBeY9lsEieyVkEB3CRXHlkX/Mttg9DjbGRxjQX+VFW3DLlHZjuONSs3nRKypHMRVNP0SqTtG4TQv5BqArDyJHon/N/mepwNR0zDT3ksUo3WW3uGI9CGcZoVCAPo0+LrjaBUvJVPwG1kqr++bKndozLuy/68hit8cuEcc2Np43Nqqd'
+set pki certificate openvpn_vtun20 private key 'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmGWtyXfMybNhB9WeVFODrqslTHHdtLAeQvrpmtQ3x5JwtKdbRDPizU+W5mG84ox/2/Sw4QRc+i4B/1TMCFDO1iVTrJzXQXQJYrCN40ZVINIt/pTJzVjaxhZctBMhSDm3TA1pP3MFQfo3OChxvmesxg5Xqe+R2b8ytP4DHMnCjD6X+J/vzRqcWAJdk2ybC3RDFqLUECBBsiNI7J9duGHN3uU9xt2VcHeWhbp/UlBz2k1tHRk+Pa8QW/WUfPJrnhxs1ZDnXTIYGpKLVgrijyzEI1xryeW0fyySSSq6C0byGaTcvNzcjEKLJdVK9OzOxLmFC1BP7GKgQqaHTnKjiYgVtAgMBAAECggEAFmWVFG3Qrjr5CiPSHMsc7QoxbXCINgNa3cyqC9FcGQLvgDOFENlD68JjVpxUWvm8BKzsuoUkYj2jTRltcFlTA6aJ+c9mtTrlZxmHCvKPw5W6PbMD04OLinJuCRb8//uMGYj5M42bz4PREThRz0ac7SdGHsEn9ERs/+txLOsDPylUZL4NrpYYespz45/AzgYflxk476l0IJhtLTY5N3XuJ7aonVZttDNA9Ds9W329spOEhvQKVKtmzMEddTAPRuk15lq+qM8qdZb+h/cmx72zCegsuKNXrMhvemcZdOqjqZGCli0p2hQawtKFzLhQUEYglUb/4lIB0Aihu84OHDchDQKBgQDSKUjW827NRQ6mysOBa7SZBreSklkXArfLc/4nasQcdeoFGO6xHGo6MR78LHuuTC2O/MDeMZ0A5PAhB5TrWxVa9FSbbLk8Ytkm9VTZjdtaVDID0RuV7fcSgvpG+msrcC238uMo2rAtE7mNWJK4COxy6vlAygt3SwXNVjh9GEBFQwKBgQDKU9v5f4uhlydW1Oj21kbPQU7vfaLt4dkzznOTSOizqRyZdihNCuvdgyKphCRVR4x/bCNQ9VpScXe4p8LnOmPDr2K7FGW2It6DWdRkqlTrFROtG9xPh1eNwzl3B+QSt7OC8+muL2gcv3V5V55mm9EojzKnlXYrs4V6Jsef3GeHjwKBgF9+eOWLGZbWQTESw0FEgnxiK/nC3A5zorYkz6BziAbyoVKNoLADnFUyysSFJfHuFWl6edy8qH2miWJIwqcq7Qo2KVeyUH0a4VctdM+iAMELrupDEwjOZ00XDMhBs366a1vBVuzSaekhpFeQnqJXE7GoCXgiFpGvGkTSX7qf0VxnAoGBAIjkBiAfuKRi9X3dXaWsQop1gGevFG5ocSGJHE9ZdAAiejQmaov9yKm90NTqj/6XAysvShG7fxnqpXrtHoR90AQVBPLYkRyTKQOr4nUdfYj0YLSt9fhk9Mr4fEfZseksGyuNxdxRPNq+e0fXDVgVMoWDpV0XVbWpp7SGymeRowZnAoGBAJXAgnKIVch/fXdoIjWFShPkZLa+784TTtg8XdYyyC/IEdgvWgNAZ71YBlIpupcORQwKFHR8wrQYj69f8U9cpkFIqB20DQr2ZG7fxLA6kCwcCt33Qx5dC0pTvKROHUyO5riuL0UOTYDmHkwNBUC+Gmcr5OJhN9KqJaAXkyekr3Xc'
+set pki dh openvpn_vtun10 parameters 'MIIBCAKCAQEA86ThynzIp1h5XN5YcVNUg+1G4EYqF81lypzqfx6zlD9eVSm6Sa1E8sOtiMg1eAnz/tJYMmStJDJRnD62oxs/dgK4Imoz5clnZd0tq/ligwG1Qt54TuQ+tlRBvQLa9r49kBRQRCka+R0YbQSaQGkwfD3VZfFX2CKeklcOnEVF5yXkaev10cBLOEXYEbdGO+WPmdkY0VXr6dzRZjkATSG+BIaKJ78y6o5sIiyxjLzJFYUQm9Kx/s+nJZLywufeycIycieMwGDyW6jewfBmdDPNgSiaDhbDpDcd7t/Qmoj01Y+z35YTnKufDCMzCfBxuV/+GM+XcbhRVFdRrgWOnnlQswIBAg=='
+set pki dh openvpn_vtun20 parameters 'MIIBCAKCAQEAle+JFVmEsawtaiX0AFEwAOhoVb6L7BY2Nh6tiVzFYiZEQoa6yMr5vi7ZGIv9n0gbaMtW+L6e7E4gJXPDSL15VW16UfNg1mXm05jpuZPpXBZndk2CtFvVZHKzH1jnpO/E4oBjgJ2H4tVjIhPhgjk/oTc8yoQuluDnkhIcBcFqkdjS/vpAzfmAxGtvcYseDS6/ZZI7z9qkYRKCm6v/i2xk+zEI9IqnmowCt+n51psMdfHSYPqXFJxfS3ok//GvcJ7f4EEYUIVFsr+FbljlNN37FDauEgNa/eOGh9DIjsoY+EWoyhbzvw2rM3Ij0zoYsc99E5+MPdXlfkSe0NesBHaK8wIBAg=='
+set pki openvpn shared-secret openvpn_vtun10_auth key '5c4fea2d9db3314af54aab7dfcf9b50cb540a015bf67aa1000e03fad65e785664fef8910c7c219a7568c77e1b51eebe38dd794e7d3718298ad1aceb02740949a65a22283df2962e1c61abee62ee9107d8572ee8e9bc15a43cda9647386c32f360002e1c3835fef4a1cb9439f8e56e93d2808102d57d2709ba2302a2b9f1ab5fe684edf584fb010e6cae580df304663553b662fb91dba47e8573870ab52511e99e59c42bce8631dfb9200fb37652efd158e656b9ed4b9b4f3e73ce8e8f918e19402b80f6b5a36239bb6a3ca6f8b09e0cb9620126d171659161615790bbf441a544911724f1b08e7d6d327cd87eeb0edfa5a2cbdd8a2e07bde2251d65b6f609439'
+set pki openvpn shared-secret openvpn_vtun10_auth version '1'
+set pki openvpn shared-secret openvpn_vtun12_crypt key '5f48386b6d3f5aa8c828d88fe5c6791fa7cd0a72b283e2c8c3d8d7171ce4dcd93c33e06b3b99cf1868ddc90e803d2eaae3278e9f9bcb937482e1b01be85a2df5ea1f1a83d07af10c9ae821655d33264937d49eedcee1b2a4f742283ebeaa75245a3d0687c0122ed7d10bfeaff97885e89514573cc566de8d7effbe0fff50e01e3d966ca8e5d5e7d756871aed46aafe4b1d20c8ef6df39c07198dcf957661aefa76e212078b7a4c2165b72929b15a1dd9c540e71a50718d3e7d1a70e85b29481e05636b9df49d2e018af79ec052dfdb99f26da65bae32923a00eeb6a1e764630c35b2a89da6092cff6cc438d4086f76792a1580af158f0b25ae41034933424d36'
+set pki openvpn shared-secret openvpn_vtun12_crypt version '1'
+set pki openvpn shared-secret openvpn_vtun20_auth key '9d530ed1da7696eb75afa37520adeecb510e3e7506ce5d73d30eaffd6b2abc527f1ccf20ae28e0834490d5fb4ef34b06979707bc0dc1950d66e051a2c52320620465e879c3278af05ba892be9c5a320a1bba19b46eff1fd13a61699d9ec5b6775d3ce3f3ba141885ee0276f2a8d545504eddd028762c4343258fa5ba9722b0d80a06571d4f6a20527ddfb63d40e588212158ed154d0a244e238274426369b256d6ac7c2161a2931f2e4afad77df7aa3f84e3728c5794fa18bb592647db77d1eb4d3a91127f3f91dcff527a5995b3f3c71cc745f27aa69659472ef337f6b4432b01792a720b9722da5bf5d9d2a6e8601f191750d6c331be9049240f1a292b370e'
+set pki openvpn shared-secret openvpn_vtun20_auth version '1'
+set pki openvpn shared-secret openvpn_vtun30_shared key '44a5889380ec775d952d94071f719bc1282e4156c9e778895892302dcfafc233e0d881e38393c033ab3067493dfbe2344c58b3c22e1ae103b12a68c00df64ca72d30e49f2b19c0ac764120ede85af5a1f9ade1752530ee7bafbf8512540d037975042d485a3661c0c70f292436bcdd9af410ce0b487ee2d717317414b659fe9d8ba892eec8c7e7816110461784a40b918d98254e7a84cd06925124887bbf6a07cc4eba384063a4dfb890ce0b76a56f55df0dc4162f653c60858c3810d01071c822cac29e77840f0dad627762020733503d7c2cb9818096ed7b16f43cafd3963fac2b95a20540ed2f4e5d46298e107baa0b3bdd0453edc82acbbb61eff4e43242'
+set pki openvpn shared-secret openvpn_vtun30_shared version '1'
+set pki openvpn shared-secret openvpn_vtun40_shared key '25f54b2c5bfc25adcd54c2107ded69fcf79fdfb80dc95272a3591ac0cf2987384beda01f91a4a6bbc8dd3123356f3d4ae53a68e6fced4542066c257f8a45e75416edee612e81dc723042e248ed408245d67d15434a98df50caa039476868f7d523088f11dcef832abb037999102abdebd1454daa4dcc58f7fa6279ea1d8c7f2f9c9fc1e155238b1a3fb011b2ef0c096afa268b08dbaf88f8a88724056811804725857423a5b634e7859596075fdbd809657bcbc912535c55d6dcda4043336bedd6cb91560a0d15f38983a498e3085a9efe4c82ebe9003161619a475f16355127a14824a1e66b8327bd7e8d6e7882b3ec89b5fd1f3008ff9f79569f0d368cfb3d'
+set pki openvpn shared-secret openvpn_vtun40_shared version '1'
+set protocols ospf area 0 network '172.18.203.0/24'
+set protocols ospf area 0 network '172.18.254.203/32'
+set protocols ospf interface eth0.203 authentication md5 key-id 10 md5-key 'ospfvyosnet'
+set protocols ospf interface eth0.203 dead-interval '40'
+set protocols ospf interface eth0.203 hello-interval '10'
+set protocols ospf interface eth0.203 passive disable
+set protocols ospf interface eth0.203 priority '1'
+set protocols ospf interface eth0.203 retransmit-interval '5'
+set protocols ospf interface eth0.203 transmit-delay '1'
+set protocols ospf log-adjacency-changes detail
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '172.18.254.203'
+set protocols ospf passive-interface 'default'
+set protocols ospf redistribute connected metric-type '2'
+set service lldp interface all
+set service ntp server time1.vyos.net
+set service ntp server time2.vyos.net
+set service ntp server time3.vyos.net
+set service ssh disable-host-validation
+set service ssh port '22'
+set system config-management commit-revisions '10'
+set system conntrack modules ftp
+set system conntrack modules h323
+set system conntrack modules nfs
+set system conntrack modules pptp
+set system conntrack modules sip
+set system conntrack modules sqlnet
+set system conntrack modules tftp
+set system console device ttyS0 speed '115200'
+set system domain-name 'vyos.io'
+set system host-name 'vyos'
+set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
+set system login user vyos authentication plaintext-password ''
+set system name-server '172.16.254.30'
+set system syslog local facility all level 'info'
+set system syslog local facility local7 level 'debug'
diff --git a/smoketest/configs/vpn-openvpn b/smoketest/configs/vpn-openvpn
new file mode 100644
index 000000000..e50a49aba
--- /dev/null
+++ b/smoketest/configs/vpn-openvpn
@@ -0,0 +1,303 @@
+interfaces {
+    dummy dum0 {
+        address 172.18.254.203/32
+    }
+    ethernet eth0 {
+        duplex auto
+        speed auto
+        vif 10 {
+            address 172.16.33.203/24
+        }
+        vif 203 {
+            address 172.18.203.10/24
+            ip {
+                ospf {
+                    authentication {
+                        md5 {
+                            key-id 10 {
+                                md5-key ospfvyosnet
+                            }
+                        }
+                    }
+                    dead-interval 40
+                    hello-interval 10
+                    priority 1
+                    retransmit-interval 5
+                    transmit-delay 1
+                }
+            }
+        }
+    }
+    ethernet eth1 {
+        duplex auto
+        speed auto
+    }
+    ethernet eth2 {
+        duplex auto
+        speed auto
+    }
+    ethernet eth3 {
+        duplex auto
+        speed auto
+    }
+    openvpn vtun10 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10010
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.10.0/24
+        }
+        tls {
+            auth-file /config/auth/openvpn/tls-auth-1.key
+            ca-cert-file /config/auth/openvpn/ca-1.crt
+            cert-file /config/auth/openvpn/openvpn-hub-1.crt
+            crl-file /config/auth/openvpn/crl-1.pem
+            dh-file /config/auth/openvpn/dh-1.pem
+            key-file /config/auth/openvpn/openvpn-hub-1.key
+        }
+    }
+    openvpn vtun11 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10011
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.11.0/24
+        }
+        tls {
+            auth-file /config/auth/openvpn/tls-auth-1.key
+            ca-cert-file /config/auth/openvpn/ca-1.crt
+            cert-file /config/auth/openvpn/openvpn-hub-1.crt
+            crl-file /config/auth/openvpn/crl-1.pem
+            dh-file /config/auth/openvpn/dh-1.pem
+            key-file /config/auth/openvpn/openvpn-hub-1.key
+        }
+    }
+    openvpn vtun12 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10012
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.12.0/24
+        }
+        tls {
+            ca-cert-file /config/auth/openvpn/ca-1.crt
+            cert-file /config/auth/openvpn/openvpn-hub-1.crt
+            crl-file /config/auth/openvpn/crl-1.pem
+            crypt-file /config/auth/openvpn/crypt-file.key
+            dh-file /config/auth/openvpn/dh-1.pem
+            key-file /config/auth/openvpn/openvpn-hub-1.key
+        }
+    }
+    openvpn vtun20 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10020
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.20.0/24
+        }
+        tls {
+            auth-file /config/auth/openvpn/tls-auth-2.key
+            ca-cert-file /config/auth/openvpn/ca-2.crt
+            cert-file /config/auth/openvpn/openvpn-hub-2.crt
+            crl-file /config/auth/openvpn/crl-2.pem
+            dh-file /config/auth/openvpn/dh-2.pem
+            key-file /config/auth/openvpn/openvpn-hub-2.key
+        }
+    }
+    openvpn vtun21 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10021
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.21.0/24
+        }
+        tls {
+            auth-file /config/auth/openvpn/tls-auth-2.key
+            ca-cert-file /config/auth/openvpn/ca-2.crt
+            cert-file /config/auth/openvpn/openvpn-hub-2.crt
+            crl-file /config/auth/openvpn/crl-2.pem
+            dh-file /config/auth/openvpn/dh-2.pem
+            key-file /config/auth/openvpn/openvpn-hub-2.key
+        }
+    }
+    openvpn vtun22 {
+        encryption {
+            cipher aes128gcm
+        }
+        hash sha1
+        local-port 10022
+        mode server
+        persistent-tunnel
+        server {
+            subnet 100.64.22.0/24
+        }
+        tls {
+            ca-cert-file /config/auth/openvpn/ca-2.crt
+            cert-file /config/auth/openvpn/openvpn-hub-2.crt
+            crl-file /config/auth/openvpn/crl-2.pem
+            crypt-file /config/auth/openvpn/crypt-file.key
+            dh-file /config/auth/openvpn/dh-2.pem
+            key-file /config/auth/openvpn/openvpn-hub-2.key
+        }
+    }
+    openvpn vtun30 {
+        local-address 100.64.30.0 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10030
+        mode site-to-site
+        remote-address 192.0.2.0
+        shared-secret-key-file /config/auth/openvpn/shared-secret-1.key
+    }
+    openvpn vtun31 {
+        local-address 100.64.30.2 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10031
+        mode site-to-site
+        remote-address 192.0.2.1
+        shared-secret-key-file /config/auth/openvpn/shared-secret-1.key
+    }
+    openvpn vtun32 {
+        local-address 100.64.30.4 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10032
+        mode site-to-site
+        remote-address 192.0.2.2
+        shared-secret-key-file /config/auth/openvpn/shared-secret-1.key
+    }
+    openvpn vtun40 {
+        local-address 100.64.40.0 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10040
+        mode site-to-site
+        remote-address 192.0.2.3
+        shared-secret-key-file /config/auth/openvpn/shared-secret-2.key
+    }
+    openvpn vtun41 {
+        local-address 100.64.40.2 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10041
+        mode site-to-site
+        remote-address 192.0.2.4
+        shared-secret-key-file /config/auth/openvpn/shared-secret-2.key
+    }
+    openvpn vtun42 {
+        local-address 100.64.40.4 {
+            subnet-mask 255.255.255.254
+        }
+        local-port 10042
+        mode site-to-site
+        remote-address 192.0.2.5
+        shared-secret-key-file /config/auth/openvpn/shared-secret-2.key
+    }
+}
+protocols {
+    ospf {
+        area 0 {
+            network 172.18.203.0/24
+            network 172.18.254.203/32
+        }
+        log-adjacency-changes {
+            detail
+        }
+        parameters {
+            abr-type cisco
+            router-id 172.18.254.203
+        }
+        passive-interface default
+        passive-interface-exclude eth0.203
+        redistribute {
+            connected {
+                metric-type 2
+            }
+        }
+    }
+}
+service {
+    lldp {
+        interface all {
+        }
+    }
+    ssh {
+        disable-host-validation
+        port 22
+    }
+}
+system {
+    config-management {
+        commit-revisions 10
+    }
+    conntrack {
+        modules {
+            ftp
+            h323
+            nfs
+            pptp
+            sip
+            sqlnet
+            tftp
+        }
+    }
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    domain-name vyos.io
+    host-name vyos
+    login {
+        user vyos {
+            authentication {
+                encrypted-password $6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/
+                plaintext-password ""
+            }
+        }
+    }
+    name-server 172.16.254.30
+    ntp {
+        server time1.vyos.net {
+        }
+        server time2.vyos.net {
+        }
+        server time3.vyos.net {
+        }
+    }
+    syslog {
+        global {
+            facility all {
+                level info
+            }
+            facility protocols {
+                level debug
+            }
+        }
+    }
+}
+
+// Warning: Do not remove the following line.
+// vyos-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@23:ipoe-server@1:ipsec@5:isis@1:l2tp@3:lldp@1:mdns@1:nat@5:ntp@1:pppoe-server@5:pptp@2:qos@1:quagga@8:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@21:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1"
+// Release version: 1.3.8
diff --git a/src/migration-scripts/interfaces/25-to-26 b/src/migration-scripts/interfaces/25-to-26
index 88b630691..e68a75d08 100644
--- a/src/migration-scripts/interfaces/25-to-26
+++ b/src/migration-scripts/interfaces/25-to-26
@@ -73,9 +73,26 @@ def migrate(config: ConfigTree) -> None:
                 key_pki_name = f'{pki_name}_shared'
 
                 if key:
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                    config.set(base + [interface, 'shared-secret-key'], value=key_pki_name)
+                    # Check if OpenVPN shared-secret already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    secret_exists = None
+                    for secret_name in config.list_nodes(pki_base + ['openvpn', 'shared-secret']):
+                        secret_path = pki_base + ['openvpn', 'shared-secret', secret_name, 'key']
+                        if not config.exists(secret_path):
+                            continue
+
+                        secret = config.return_value(secret_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if secret == wrapped_pem_to_config_value(key):
+                            secret_exists = secret_name
+                            break
+
+                    if secret_exists:
+                        config.set(base + [interface, 'shared-secret-key'], value=secret_exists)
+                    else:
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                        config.set(base + [interface, 'shared-secret-key'], value=key_pki_name)
                 else:
                     print(f'Failed to migrate shared-secret-key on openvpn interface {interface}')
 
@@ -94,9 +111,26 @@ def migrate(config: ConfigTree) -> None:
                 key_pki_name = f'{pki_name}_auth'
 
                 if key:
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                    config.set(base + [interface, 'tls', 'auth-key'], value=key_pki_name)
+                    # Check if OpenVPN auth key already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    secret_exists = None
+                    for secret_name in config.list_nodes(pki_base + ['openvpn', 'shared-secret']):
+                        secret_path = pki_base + ['openvpn', 'shared-secret', secret_name, 'key']
+                        if not config.exists(secret_path):
+                            continue
+
+                        secret = config.return_value(secret_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if secret == wrapped_pem_to_config_value(key):
+                            secret_exists = secret_name
+                            break
+
+                    if secret_exists:
+                        config.set(base + [interface, 'tls', 'auth-key'], value=secret_exists)
+                    else:
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                        config.set(base + [interface, 'tls', 'auth-key'], value=key_pki_name)
                 else:
                     print(f'Failed to migrate auth-key on openvpn interface {interface}')
 
@@ -112,9 +146,26 @@ def migrate(config: ConfigTree) -> None:
                 key_pki_name = f'{pki_name}_crypt'
 
                 if key:
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                    config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                    config.set(base + [interface, 'tls', 'crypt-key'], value=key_pki_name)
+                    # Check if OpenVPN auth key already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    secret_exists = None
+                    for secret_name in config.list_nodes(pki_base + ['openvpn', 'shared-secret']):
+                        secret_path = pki_base + ['openvpn', 'shared-secret', secret_name, 'key']
+                        if not config.exists(secret_path):
+                            continue
+
+                        secret = config.return_value(secret_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if secret == wrapped_pem_to_config_value(key):
+                            secret_exists = secret_name
+                            break
+
+                    if secret_exists:
+                        config.set(base + [interface, 'tls', 'crypt-key'], value=secret_exists)
+                    else:
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                        config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                        config.set(base + [interface, 'tls', 'crypt-key'], value=key_pki_name)
                 else:
                     print(f'Failed to migrate crypt-key on openvpn interface {interface}')
 
@@ -144,8 +195,26 @@ def migrate(config: ConfigTree) -> None:
                             if cert:
                                 ca_certs[f'{pki_name}_{index}'] = cert
                                 cert_pem = encode_certificate(cert)
-                                config.set(pki_base + ['ca', f'{pki_name}_{index}', 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                                config.set(x509_base + ['ca-certificate'], value=f'{pki_name}_{index}', replace=False)
+
+                                # Check if CA already exists - no need to check node existence as
+                                # it is always created above when entering this context
+                                ca_exists = None
+                                for ca_name in config.list_nodes(pki_base + ['ca']):
+                                    ca_cert_path = pki_base + ['ca', ca_name, 'certificate']
+                                    if not config.exists(ca_cert_path):
+                                        continue
+
+                                    ca_base64 = config.return_value(ca_cert_path)
+                                    # Check for duplicate cert/key - and re-use if possible
+                                    if ca_base64 == wrapped_pem_to_config_value(cert_pem):
+                                        ca_exists = ca_name
+                                        break
+
+                                if ca_exists:
+                                    config.set(x509_base + ['ca-certificate'], value=ca_exists, replace=False)
+                                else:
+                                    config.set(pki_base + ['ca', f'{pki_name}_{index}', 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                                    config.set(x509_base + ['ca-certificate'], value=f'{pki_name}_{index}', replace=False)
                             else:
                                 print(f'Failed to migrate CA certificate on openvpn interface {interface}')
 
@@ -180,7 +249,23 @@ def migrate(config: ConfigTree) -> None:
 
                 if crl and crl_ca_name:
                     crl_pem = encode_certificate(crl)
-                    config.set(pki_base + ['ca', crl_ca_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem))
+
+                    # Check if CRL already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    crl_exists = None
+                    for ca_name in config.list_nodes(pki_base + ['ca']):
+                        crl_path = pki_base + ['ca', ca_name, 'crl']
+                        if not config.exists(crl_path):
+                            continue
+
+                        crl_base64 = config.return_value(crl_path)
+                        # Check if CRL is a duplicate and we have already imported it
+                        if crl_base64 == wrapped_pem_to_config_value(crl_pem):
+                            crl_exists = ca_name
+                            break
+
+                    if not crl_exists:
+                        config.set(pki_base + ['ca', crl_ca_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem))
                 else:
                     print(f'Failed to migrate CRL on openvpn interface {interface}')
 
@@ -205,8 +290,25 @@ def migrate(config: ConfigTree) -> None:
 
                 if cert:
                     cert_pem = encode_certificate(cert)
-                    config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                    config.set(x509_base + ['certificate'], value=pki_name)
+                    # Check if certificate public key already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    cert_exists = None
+                    for cert_name in config.list_nodes(pki_base + ['certificate']):
+                        cert_path = pki_base + ['certificate', cert_name, 'certificate']
+                        if not config.exists(cert_path):
+                            continue
+
+                        cert_base64 = config.return_value(cert_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if cert_base64 == wrapped_pem_to_config_value(cert_pem):
+                            cert_exists = cert_name
+                            break
+
+                    if cert_exists:
+                        config.set(x509_base + ['certificate'], value=cert_exists)
+                    else:
+                        config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                        config.set(x509_base + ['certificate'], value=pki_name)
                 else:
                     print(f'Failed to migrate certificate on openvpn interface {interface}')
 
@@ -227,7 +329,22 @@ def migrate(config: ConfigTree) -> None:
 
                 if key:
                     key_pem = encode_private_key(key, passphrase=None)
-                    config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
+                    # Check if certificate public key already exists - no need to check node
+                    # existence as it is always created above when entering this context
+                    key_exists = None
+                    for key_name in config.list_nodes(pki_base + ['certificate']):
+                        key_path = pki_base + ['certificate', key_name, 'private', 'key']
+                        if not config.exists(key_path):
+                            continue
+
+                        key_base64 = config.return_value(key_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if key_base64 == wrapped_pem_to_config_value(key_pem):
+                            key_exists = key_name
+                            break
+
+                    if not key_exists:
+                        config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
                 else:
                     print(f'Failed to migrate private key on openvpn interface {interface}')
 
@@ -252,8 +369,26 @@ def migrate(config: ConfigTree) -> None:
 
                 if dh:
                     dh_pem = encode_dh_parameters(dh)
-                    config.set(pki_base + ['dh', pki_name, 'parameters'], value=wrapped_pem_to_config_value(dh_pem))
-                    config.set(x509_base + ['dh-params'], value=pki_name)
+
+                    # Check if DH parameters already exists - no need to check node existence
+                    # as it is always created above when entering this context
+                    dh_exists = None
+                    for dh_name in config.list_nodes(pki_base + ['dh']):
+                        dh_param_path = pki_base + ['dh', dh_name, 'parameters']
+                        if not config.exists(dh_param_path):
+                            continue
+
+                        dh_base64 = config.return_value(dh_param_path)
+                        # Check for duplicate cert/key - and re-use if possible
+                        if dh_base64 == wrapped_pem_to_config_value(dh_pem):
+                            dh_exists = dh_name
+                            break
+
+                    if dh_exists:
+                        config.set(x509_base + ['dh-params'], value=dh_exists)
+                    else:
+                        config.set(pki_base + ['dh', pki_name, 'parameters'], value=wrapped_pem_to_config_value(dh_pem))
+                        config.set(x509_base + ['dh-params'], value=pki_name)
                 else:
                     print(f'Failed to migrate DH parameters on openvpn interface {interface}')