I've create a site-to-site OpenVPN structure on pfsense 2.2 using the built in certificate manager and the following:
- There is a root CA and an intermediate CA from which the server and client certs are issued.
- The full chain is distributed to the OpenVPN client.
- The server has the Peer Certificate Authority set to the intermediate CA
- The server has the Server Certificate set to a cert issued from the intermediate CA
- The Server has the Peer CRL set to a CRL created from the intermediate CA
- The clients connect and operate fine but the logs continue to give me:
... CRL /var/etc/openvpn/server3.crl-verify is from a different issuer than the issuer of ...
I've tried replacing the Peer CA and CRL with the root CA (in the OpenVPN config) and the same occurs. I've tried all combinations of chained certificates on the client side. Same log message.
Any idea what I'm missing? It seems that not only is the CRL not being honoured but not even having any effect.
