Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenVPN server that only a few clients are using and due to heartbleed issue, I've simply recreated the server certificates.

I've also deleted all the previous certificate files from the server. My assumption is since I've regenerated the server certificates and keys, previously generated client certificates can't connect to server anymore, since their certificates are not signed with the new server certificates I've created.

I'm perfectly happy with this, I just want to make sure that someone can't connect using an old certificate. Am I right?

More details: I've followed the OpenVPN guide here and (hopefully) rebuilt the certificate authority as well by doing:

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca

Just before the steps above the guide says:

Enter the following to generate the master Certificate Authority (CA) certificate and key:

So my guess is I've replaced everything. My problem is I do not have the old certificates and in order to revoke them I need them!

Even more details: I've gotten hold of a previously working client certificate and configuraiton and if I try to connect using that I get:

Wed Apr 16 17:48:22 2014 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

So I think this is proof that previous client certificates will not work.

share|improve this question
1  
Yes, creating a new CA cert will allow only the certificates signed by that cert to connect. Certificates signed by the old CA will be rejected. –  Sammitch Apr 16 at 19:34
    
Thanks! Care to write this as an answer so that I can accept it? –  sarikan Apr 16 at 19:43
1  
assuming you actually made a new ca cert, and not just a new server cert and client certs. In that case, you'll need to revoke the old certs and use a crl file in the server's openvpn config. –  Sirex Apr 16 at 20:25
1  
Sirex has a good point here: you don't say whether or not you've changed the CA root. You don't actually need to (see this question for details) but if you haven't, and you haven't both revoked the old certificates and configured the OpenVPN server to use that CRL, then the old clients will indeed still be able to connect: their certificates are signed by a CA the server continues to regard as valid. –  MadHatter Apr 16 at 21:12
    
@MadHatter I've updated the question. Do I still sound right? –  sarikan Apr 16 at 22:45

1 Answer 1

up vote 3 down vote accepted

No, pre-existing clients using certificates signed by the previous CA certificate will no longer be able to connect when the CA cert/key are removed/regenerated.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.