I've run into a problem, that I removed certificate files from the server.
But client that has these files still can connect.
I've found out, that I should revoke the certificate and that this can be done by changing line with that certificate in
to have R, not V, as first character line.
But previously I've removed line for that certificate from the file, because attempt to generate that certificate again just gave an 0 byte size file.
As I've read, it shouldn't be able to connect after removing from
index.txt, but it does connect.
What may cause the problem and how am I able to disallow that particular certificate to connect?
I want be able to create certificate with same name, CN, and other vars I set for each certificate, as the one being disallowed - newly created certificate should have the ability to connect.
Solution was undoing changes in
index.txt (changing R back to V in cert I wished to revoke) and generating CRL in
easy-rsa, which was missing.
The index.txt mustn't be manually changed in way I did it, because it was lacking revoke date and did not allow me to generate missing CRL. I found out, that revocation should be done by
/etc/openvpn/easy-rsa/revoke-full <cert name>, with all vars as when cert was generated, in my case.