It seems that later versions of OpenVPN doesn't understand multiple PEM encoded CRLs in one file.
If you edit you CRL file so that it contains only the CRL of the client certificate issuing CA, you'll see that you won't get errors for
depth=0 and will instead get an error for
depth=1. You'll probably get the same results if you swap the order of the CRLs in your current file.
To resolve this on later versions of OpenVPN you should use the
Directory containing trusted certificates (CAs and CRLs). Not available with mbed TLS.
Place all your CA certificates and the CRLs generated by your CAs in a directory pointed to by the
--capath option. Remember to remove the
c_rehash <path to certs and CRLs> to generate a hash of the certificates and their CRLs.
Restart OpenVPN and you should find your logs are devoid of CRL warnings.
Note: You should never get an CRL warning for
depth=2 (your root CA) as it will be a self-signed certificate and a CRL for one of those is pointless because it would be signed by itself. But it seems that if you omit the root CA's CRL, it shows a verify warning for itself (
depth=2) as well as the certificate it issued (the intermediate CA at
depth=1). It should only show a warning for the latter.