Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my intermediate CA and copy the new crl.pem file to the openvpn server I get this message :

CRL: CRL /etc/openvpn/crl.pem is from a different issuer than the issuer of certificate

I have read through all the openvpn doco but nothing talks about revoking a cert/user with an intermediate CA. Functionally the CRL works - ie the revoked cert/user isn't able to connect.

I am pretty sure that openvpn is complaining cuz it doesn't have the entire CA chain but am not entirely sure - can anyone explain why I get this?

share|improve this question
up vote 0 down vote accepted

looks like you've found a (minor) bug in openvpn. You should have the full (public) CA chain on the server by stacking the CA and subCA certs together. When a client connects the verify process goes through the entire chain and it tries to find a matching CRL. As there is no CRL for the intermediate CA itself this message is printed, which is bogus.

What you should see as well is


As long as you see that the cert issued by the intermediate CA is properly revoked.



share|improve this answer
Ok, can I stack them together by concatenating the files together? Should I report this to the Openvpn team? – Hilton D Oct 21 '10 at 12:35
Yes you can stack CRLs just like CA files. And yes, this should be reported to the OpenVPN team as a (minor) issue : your setup should be working but the warning is spurious and misleading. – janjust Oct 25 '10 at 10:21
Thanks for your help :) – Hilton D Oct 26 '10 at 11:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.