Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I used the easy-rsa/2.0 programs to build server and client certificates for OpenVPN. I copied the client ones to the clients along with ca.crt. All good.

I now need to revoke a client certificate from a stolen laptop. In /usr/share/doc/openvpn/examples/easy-rsa/2.0 there's a revoke script. I've run this successfully and it says "Data Base Updated". It's created some files in a subdir of the examples/doc folder.

I've copied the created crl.pem to /etc/openvpn/crl.pem and I've added crl-verify /etc/openvpn/crl.pem to server.conf.

Is there any way I can verify that I've done the right thing and that it will indeed block access?

Also, I'm not clear where this "Data Base" is stored or what it refers to? Is there any way to inspect this database?

share|improve this question
2  
1. Create your test-cert (with a matching openvpn account), 2. Try to login 3. Revoke cert, update crl, check whether (2) still works...? –  Michuelnik Sep 11 '12 at 12:37
1  
The "data base" is the index.txt file in your easy-rsa directory somewhere. The first column indicates the state of a given certificate that's been signed. If it's an "R" then that cert has been revoked. Your CRL file is derived from index.txt. If you want to test OpenVPN functionality with regard to the CRL, do what Michuelnik suggested. –  cjc Sep 11 '12 at 12:49

2 Answers 2

up vote 1 down vote accepted

On easy-rsa directory there's a 'revoke-full' file. When you run this script with your user/key as parameter, index.txt file on easy-rsa/keys directory will be updated.

You'll see an 'R' (for Revoked) on the first column from the left for your user.

share|improve this answer
    
But how does OpenVPN know of index.txt's existence? Where in the config file do you tell it where to find index.txt? Or maybe it just goes on the crl.pem file? –  artfulrobot Sep 12 '12 at 16:07

Use

./list-crl 

from easy-rsa directory to display serial numbers of revoked certificates.

Also check the openvpn logs for "CRL CHECK FAILED" message.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.