Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used the easy-rsa/2.0 programs to build server and client certificates for OpenVPN. I copied the client ones to the clients along with ca.crt. All good.

I now need to revoke a client certificate from a stolen laptop. In /usr/share/doc/openvpn/examples/easy-rsa/2.0 there's a revoke script. I've run this successfully and it says "Data Base Updated". It's created some files in a subdir of the examples/doc folder.

I've copied the created crl.pem to /etc/openvpn/crl.pem and I've added crl-verify /etc/openvpn/crl.pem to server.conf.

Is there any way I can verify that I've done the right thing and that it will indeed block access?

Also, I'm not clear where this "Data Base" is stored or what it refers to? Is there any way to inspect this database?

share|improve this question
1. Create your test-cert (with a matching openvpn account), 2. Try to login 3. Revoke cert, update crl, check whether (2) still works...? – Michuelnik Sep 11 '12 at 12:37
The "data base" is the index.txt file in your easy-rsa directory somewhere. The first column indicates the state of a given certificate that's been signed. If it's an "R" then that cert has been revoked. Your CRL file is derived from index.txt. If you want to test OpenVPN functionality with regard to the CRL, do what Michuelnik suggested. – cjc Sep 11 '12 at 12:49
up vote 2 down vote accepted

On easy-rsa directory there's a 'revoke-full' file. When you run this script with your user/key as parameter, index.txt file on easy-rsa/keys directory will be updated.

You'll see an 'R' (for Revoked) on the first column from the left for your user.

share|improve this answer
But how does OpenVPN know of index.txt's existence? Where in the config file do you tell it where to find index.txt? Or maybe it just goes on the crl.pem file? – artfulrobot Sep 12 '12 at 16:07
@artfulrobot You need to setup the OpenVPN server to add support for revoking certificates adding crl-verify /etc/openvpn/keys/crl.pem to your config and reloading to activate this setting. – Alberto Spelta Jun 11 '15 at 9:35



from easy-rsa directory to display serial numbers of revoked certificates.

Also check the openvpn logs for "CRL CHECK FAILED" message.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.