Whitelist a certificate in openvpn

Question

To revoke the access to a client, I can do

$./revoke-full client_name

And then place the new crl.pem in the server.

But, how do I re-enable that client? Removing the crl.pem file is not a solution because this will break easy-keys directory and I won't be able to revoke them again, later.

Answer 1

Certificates should never be unrevoked! You should generate a new one, and give it to the client.

...but still, if you wish:

in your CA folder, there should be an index.txt, with certificate IDs in it. The ones starting with "V" are valid, and ones with "R" are revoked. You can edit that file, and fix the first char to "V", and delete the third column (the revocation date). If you have more then one certificate, you should see the pattern (sequential number comes in the third column now, etc).

Then you just need to regenerate the CRL again, and it should work.

This is an ugly hack,... I still recommend generating a new cert for the client.

Answer 2

While revocation toggling is a not so good practice at all, there is some special case where unrevoking a key (like an undo) could be usefull.

Worst: A crt could never be deleted instead of very specific cases, like studying. At end of this, you may see how I delete the last index entry (as an undo action).

unrevoke

There is a little unrevoke script I wrote.

As this is not a standard feature, I've added a kind of log file, called unrevoke.txt, in ASCII format and reusing the structure of index.txt (tab separated):

U | Revocation date | Unrevocation date | Id | unknown | Subject

Warn: It work for my need, but you have to test them before regular use!

#!/bin/bash

# un-revoke a certificate, regenerate CRL,
# and verify revocation status

CRL=crl.pem

if test $# -ne 1; then
    echo "usage: unrevoke <name|idx>";
    exit 1
fi

if test $KEY_DIR; then
    cd $KEY_DIR
    read issuer < <(openssl x509 -issuer -noout -in $KEY_DIR/ca.crt)
    issuer=${issuer#*CN=}
    issuer=${issuer%%/*}
    export KEY_CN=$issuer KEY_OU=$issuer KEY_NAME=$issuer

    if [ -f $1.crt ] ;then
        NAM=$1
    REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t\([0-9A-F]\{2,8\}\)\tunknown\t\(.*CN=$1\/.*\)$/\1 \2 \3/p"))
        IDX=${REV[1]}
        SUB="${REV[@]:2}"
    else
        if [ -f $1.pem ] ;then
            IDX=$1
            REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t$1\tunknown\t\(.*CN=\([^\/]\+\)\/.*\)$/\1 \3 \2/p"))
            NAM=${REV[1]}
            SUB="${REV[@]:2}"
        fi
    fi
    CRT=$IDX.pem
    if [ -f $CRT ] && [ "$NAM" ] && [ "$IDX" ] ;then
        printf "Key idx: %s, name: %s\n" $IDX $NAM
    else
        echo Key $1 not found.
        exit 1
    fi

    DTE=$(date +"%y%m%d%H%M%SZ")
    # unrevoke key
    sed -e "s/^R\t\([0-9]\+Z\)\t[0-9]\+Z\t$IDX\t/V\t\1\t\t$IDX\t/" -i.old index.txt &&
        printf "U\t%s\t%s\t%s\tunknown\t%s\n" $REV $DTE $IDX "$SUB" >>unrevoke.txt

    # generate a new CRL
    openssl ca -gencrl -out $CRL -config $KEY_CONFIG

    # verify the revocation
    openssl verify -CAfile <(cat ca.crt $CRL) -crl_check $CRT
else
    echo you must define KEY_DIR
fi

delete-last

For info only!!: key as to NEVER be deleted in order to permit his revocation!

#!/bin/bash
# For info only!!
# key as to NEVER be deleted
# for making a correct revocation liste
#
# Don't use it unless you're sure you know what you're doing!!!

cd $KEY_DIR || exit 1

mapfile index <index.txt
OIFS="$IFS"
IFS=$'\t'
line=(${index[${#index[@]}-1]})
IFS="$OIFS"
if [ "$line" == "V" ] ;then
    idx=${line[2]}
    nam=${line[4]#*CN=}
else
    idx=${line[3]}
    nam=${line[5]#*CN=}
fi
nam=${nam%%/*}
rm -v $nam.* $idx.*
unset index[${#index[@]}-1]
cat index.txt >index.txt.old 
printf "%s" "${index[@]}" >index.txt
cat serial >serial.old 
echo ${line[2]} >serial