diff --git a/experiments/.dockerignore b/experiments/.dockerignore
new file mode 100644
index 0000000..0d13a98
--- /dev/null
+++ b/experiments/.dockerignore
@@ -0,0 +1 @@
+openvpn
\ No newline at end of file
diff --git a/experiments/.gitignore b/experiments/.gitignore
new file mode 100644
index 0000000..9f5760a
--- /dev/null
+++ b/experiments/.gitignore
@@ -0,0 +1 @@
+openvpn/pki
\ No newline at end of file
diff --git a/experiments/Dockerfile b/experiments/Dockerfile
new file mode 100644
index 0000000..7a1a7ba
--- /dev/null
+++ b/experiments/Dockerfile
@@ -0,0 +1,12 @@
+FROM alpine:latest
+# LABEL maintainer=""
+
+RUN set -ex; \
+    \
+    apk --no-cache add \
+      easy-rsa \
+    ; \
+    ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin;
+
+WORKDIR "/opt/openvpn"
+
diff --git a/experiments/openvpn/build_ca.sh b/experiments/openvpn/build_ca.sh
new file mode 100755
index 0000000..6adf3c2
--- /dev/null
+++ b/experiments/openvpn/build_ca.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -ex
+
+easyrsa init-pki
+easyrsa --batch --passout="pass:passwd" --passin="pass:passwd" --req-cn="kiwi-vpn" --days="$(( 365 * 50 ))" build-ca
+easyrsa --batch --passin="pass:passwd" --days="$(( 365 * 50 ))" build-server-full bababooey nopass
+