I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my intermediate CA and copy the new crl.pem file to the openvpn server I get this message :
CRL: CRL /etc/openvpn/crl.pem is from a different issuer than the issuer of certificate
I have read through all the openvpn doco but nothing talks about revoking a cert/user with an intermediate CA. Functionally the CRL works - ie the revoked cert/user isn't able to connect.
I am pretty sure that openvpn is complaining cuz it doesn't have the entire CA chain but am not entirely sure - can anyone explain why I get this?