Revoke multiple client certs signed by one CA: only the first one got denied?

Question

• OS: Ubuntu 12.04
• OpenVPN version: 2.2.1-8
• Setup: one CA cert, one server cert, multiple client certs

Server config:

port 1194
proto udp
dev tun
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/team.log
syslog vpn-team
verb 4
writepid /var/run/openvpn-team.pid
ca /etc/openvpn/ca.crt
cert /etc/openvpn/team/server.crt
key /etc/openvpn/team/server.key  # This file should be kept secret
dh /etc/openvpn/dh.pem
server 172.16.255.128 255.255.255.128
ifconfig-pool-persist /etc/openvpn/team/ipp.txt
client-to-client
push "route 172.16.0.0 255.255.254.0"
crl-verify crl.pem

client config:

dev tun
proto udp
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
comp-lzo
verb 4
client
remote x.x.x.x 1194
ca ca.crt
cert team.crt
key team.key
remote-cert-tls server

Using revoke-full script from easy-rsa package, I saw that it only output the last one into a crl.pem file:

# generate a new CRL -- try to be compatible with
# intermediate PKIs
$OPENSSL ca -gencrl -out "$CRL" -config "$KEY_CONFIG"

In my case, I wrote a script to append to that file but only the first one got denied, all other one can still connect.

Using openssl crl, it just show the serial of the first one:

Revoked Certificates:
    Serial Number: E9955907C7F48BDDFCADCFECFAEDC8B7
        Revocation Date: Feb 11 08:57:19 2015 GMT

So, the question is: does crl-verify support a concatenated CRL file? Is it a limit of openssl?

Related:

• http://openvpn.net/archive/openvpn-users/2007-02/msg00191.html
• http://openvpn.net/archive/openvpn-devel/2005-05/msg00018.html
• https://groups.google.com/forum/#!topic/openvpn-users/g2GdaotzB5Q

Answer 1

So, the question is: does crl-verify support a concatenated CRL file?

No. The crl.pem is just something like this:

-----BEGIN X509 CRL-----
MIICAzCB7DANBgkqhkiG9w0BAQQFADCBlTELMAkGA1UEBhMCVVMxEzARBgNVBAgT
CkNhbGlmb3JuaWExFTATBgNVBAcTDFJlZHdvb2QgQ2l0eTESMBAGA1UEChMJUnVu
d2F5IDIwMREwDwYDVQQLEwhEZXYgVGVhbTETMBEGA1UEAxMKb3BlbnZwbi1jYTEe
MBwGCSqGSIb3DQEJARYPaW5mb0BydW53YXkuY29tFw0xNTAyMTMwNjAwMzJaFw0x
NTA1MjQwNjAwMzJaMCUwIwIQUp+UnftT7IKiLOnT/6OachgPMjAxNTAyMTMxMzAw
1tYZj9iJzdzOsRbcK10FrwswLJ8ZNKWvLHfiqOVr7JakxCM3e8uVuMwtkEugHnmB
HjtU39ero7j3AUZZHETQaMnJvnQAMqcy+RKCDWDuxzBWr5vxkY85AatQmz2SfNAi
5F93UXQyegXpQohmkQaq7mSDbpeO163G5n9MqOGdG2fIYYOQSkgl+h2/hx/+9+jC
8y491cg/evAWerSVFVrzaA1T5dmhSBX6Awb9RnxDvo8ZlJufjOqhxMwU8J19RYOj
M2Rk9JQ5Wvgq4Q+3qM0uEhHVFfSaAUvGqTHJwqtgPR23x7F00jNB
-----END X509 CRL-----

but using openssl crl -in /path/to/crl.pem -text -noout, if multiple certs has been revoked, you will see something like this:

Revoked Certificates:
    Serial Number: 01
        Revocation Date: Feb 13 14:59:08 2015 GMT
    Serial Number: 02
        Revocation Date: Feb 13 14:59:10 2015 GMT

I wrote a script to append to that file but only the first one got denied, all other one can still connect.

I was wrong at this step. Read the revoke-full script carefully:

# revoke key and generate a new CRL
$OPENSSL ca -revoke "$1.crt" -config "$KEY_CONFIG"

# generate a new CRL -- try to be compatible with
# intermediate PKIs
$OPENSSL ca -gencrl -out "$CRL" -config "$KEY_CONFIG"

OpenSSL has an index.txt file where it keep all cert info:

• status: (V)alid, (E)xpired, (R)evoked
• expiry date
• revocation date
• serial number
• file name of the cert (unknown)
• subject

The first command (openssl ca -revoke) actually update that index.txt file to replace V (valid) with R (revoke). The second command (openssl ca -gencrl) create a crl.pem file based on index.txt and CA cert/key.

So, don't append to the existing crl.pem file, just update the index.txt first, then re-generate CRL.