Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got myself into a pretty messy situation:

  1. I generated a clients self-signed certificate on server A, with server A being the CA.
  2. I then copied the self-signed certificate (.crt, .key) to server B, which is also a CA by itself.
  3. I started using this self-signed certificate on server B and it worked, so I didn't think too much afterward.

Now, I need to revoke this self-signed certificate, however I cannot do it on server B (it complaints about "name does not match"). I've managed to revoke it on server A which signed it, but how can I let server B know that this certificate has indeed been revoked?

I tried to copy the revoked cert over to server B but it doesn't really work...


  • server A: Ubuntu server 10.10, openssl version 0.9.8o
  • server B: CentOS 4.4, openssl version 0.9.7a

If there's anything else I can provide please let me know.

Hope my explanation makes sense, if not, please leave me a msg. Any help would be very much appreciated!

share|improve this question

You must have copied the server and client certificates from A to B if the same client certs still work when authenticating to B. Is this not the case? If you only moved the client certs, and not the server cert, but you can still authenticate to B with client certs from A, then you must have the same CA on A and B.

You don't need to copy the revoked cert to B, you just need to add the cert to B's revocation list. Normally, as long as the server and client certs are signed by the same CA, authentication will proceed. Revocation works by adding entries to a text file. When you authenticate with a cert, OpenVPN will check your Certificate Revocation List (CRL) to see if the cert has been revoked. You're not making any changes to the actual cert.

share|improve this answer
Thanks very much Cocabean! Yeah after a few hours searching/playing with it I figured the trick is on the CRL. However I'm pretty sure server A and B use different CA, and yet for some reason client cert signed by server A works on server B.... I'll try to add client cert to the CRL on server B now, see if it works! – tw79 May 24 '11 at 4:41
Sorry Cocoabean under the easy-rsa/keys/ directory where i store my keys, can you point to me where I can add my revoked cert entry to? i'm feeling it should be index.txt but after adding it, "openssl crl -text -noout -in ca.crt" still shows no revoked certs???? thanks very much! – tw79 May 24 '11 at 5:03
OK - I copied the corresponding entry from server A's index.txt to server B's index.txt, then i generated a new CRL: newcrl.pem. After that, running "openssl crl -text -noout -in newcrl.pem" shows that entry 13 is revoked, but somehow I'm still able to OpenVPN in using the revoked cert! i'm lost...... – tw79 May 24 '11 at 5:24
Your best bet would probably be to just either recopy everything from server A to server B as server A currently is. Otherwise, just run the clean-all script and start from scratch on box B. The whole process is a few scripts. You could even copy just the CA over from server A and give B a unique cert using the same CA. – Cocoabean May 24 '11 at 6:51
Thanks I think I'll wipe everything and start clean again. THanks for the help! – tw79 May 25 '11 at 4:09

To set up this trust, the clients must trust the root of the server’s certificate. This means, clients have to possess the certificate of the certification authority that issued the server certificate in their Trusted Root Certification Authorities store. You can observe this store via the Certificates snap-in.

The process is mandatory if you are using a certificate not issued by a third part vendor.

Important To install the server root certificate, do the following on the client.

To install the root Certificate on the client

  1. Open the Certificates snap-in console. If you have not previously added in the Certificates snap-in console, you can achieve this by doing the following: • Click Start, select Run, type mmc, and then tap OK. • On the File menu, choose Add/Remove Snap-in. • In the Add or Remove Snap-ins dialog box, in the Available snap-ins file, choose Certificates, and then click Add. • In the Certificates snap-in dialog box, select Computer account, and at that time click Next. • In the Select Computer dialog box, click Local computer: (the computer this console is running on), followed by selecting Finish. • In the Add or Remove snap-ins dialog box, click OK.

  2. In the Certificates snap-in console, in the console tree, double click to show more items on Certificates (Local Computer), repeat previous step with Trusted Root Certification Authorities, right-click Certificates, and focus on All Tasks, followed by selecting Import.

  3. Once you get to the Welcome to the Certificate Import Wizard page, select Next.
  4. On the File to Import page, in the File name box, indicate the title of the server root certificate, then select Next.
  5. On the Password page, if you created a pass phrase for the private key linked with the certificate previously, enter the pass phrase.
  6. On the Certificates Store page, allow the default selection (Place all certificates in the following store – Trusted Root Certification Authorities), followed by choosing Next.
  7. On the Completing the Certificate Import Wizard page, verify that the certificate settings appear as followed: • Certificate Store Selected by User: Trusted Root Certification Authorities • Content: Certificate • File Name: FilePath\, where is the name of the server root certificate.

  8. Select Finish.

  9. Once the certificate upload has successfully concluded, a confirmation message will show up proving the import was successful. Select OK.
  10. With Certificates chosen in the console hierarchy, in the detail panel, confirm that the root certificate of the server has become visible in the file of certificates on the client.

This process can be modified on client computers to use website certificates, remote desktop certificates, and Exchange certificates.

share|improve this answer
Not cool Shawn, not cool at all - firstly we don't do spam in our posts and secondly this 'answer' is not just wrong it's based on the wrong OS ffs! - I'm leaving this comment in place to let you know the mods here are keeping a close eye on you. Fix this 'answer' and don't do this again or we'll destroy your account and ban you. – Chopper3 Jun 21 '11 at 19:22
I'd be ashamed to have my company's name tied to an answer like this. – MDMarra Jun 21 '11 at 19:27
At least he's stealing from himself (…) and (…) – Chopper3 Jun 21 '11 at 19:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.