0

I have an OpenVPN server that only a few clients are using and due to heartbleed issue, I've simply recreated the server certificates.

I've also deleted all the previous certificate files from the server. My assumption is since I've regenerated the server certificates and keys, previously generated client certificates can't connect to server anymore, since their certificates are not signed with the new server certificates I've created.

I'm perfectly happy with this, I just want to make sure that someone can't connect using an old certificate. Am I right?

More details: I've followed the OpenVPN guide here and (hopefully) rebuilt the certificate authority as well by doing:

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca

Just before the steps above the guide says:

Enter the following to generate the master Certificate Authority (CA) certificate and key:

So my guess is I've replaced everything. My problem is I do not have the old certificates and in order to revoke them I need them!

Even more details: I've gotten hold of a previously working client certificate and configuraiton and if I try to connect using that I get: 

Wed Apr 16 17:48:22 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

So I think this is proof that previous client certificates will not work.

Improve this question
5
  • 1
    Yes, creating a new CA cert will allow only the certificates signed by that cert to connect. Certificates signed by the old CA will be rejected.
    – Sammitch
    Apr 16, 2014 at 19:34
  • 1
    assuming you actually made a new ca cert, and not just a new server cert and client certs. In that case, you'll need to revoke the old certs and use a crl file in the server's openvpn config.
    – Sirex
    Apr 16, 2014 at 20:25
  • 1
    Sirex has a good point here: you don't say whether or not you've changed the CA root. You don't actually need to (see this question for details) but if you haven't, and you haven't both revoked the old certificates and configured the OpenVPN server to use that CRL, then the old clients will indeed still be able to connect: their certificates are signed by a CA the server continues to regard as valid.
    – MadHatter
    Apr 16, 2014 at 21:12
  • @MadHatter I've updated the question. Do I still sound right?
    – mahonya
    Apr 16, 2014 at 22:45
  • Sounds good to me.
    – MadHatter
    Apr 17, 2014 at 5:58

1 Answer 1

Reset to default
3

No, pre-existing clients using certificates signed by the previous CA certificate will no longer be able to connect when the CA cert/key are removed/regenerated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .