Hello! 3 months ago I had problem with hard disk drive and I've lost data stored in: c:\Program Files\OpenVPN\easy-rsa\keys\ I had a backup but 1 month old. Now i have to revoke a certificate that was created in that unlucky month. When I type: [code]vars.bat revoke-full.bat szlendakm[/code] I receive an error message: [quote]ERROR:name does not match /C=PL/ST=....................[/quote] I've read similar topic "revoke user with 'ERROR:name does not match'" (https://forums.openvpn.net/topic7979.html) but it does not match my problem. I'm aware that file c:\Program Files\OpenVPN\easy-rsa\keys\index.txt stores data about *.pem, but I don't have *.pem for that certificate. Is there any chance to revoke certyficate without XX.pem for that certificate? What should I do?

you can try to re-create index.txt (if you have the certs that created last month) and then try to revoke them.. just my 2 cents. Michael.

in order to revoke a certificate you need the certificate DN (/C=PL/.... etc) and its serial number; if you no longer have the serial numbers and cannot predict them then you're in trouble....

Serial number is in *.crt and I have it. Problem is that I've created many new certifacates after that and this serial number was overwritten. Now I created identical certyficate szlendakm with identical name and switch them. index.txt now has that name, but still I can't revoke it! [quote]ERROR:name does not match /C=PL/ST=....................[/quote] What should I do?! How to block that connection?

you can't revoke the certificate if you don't know the serial number.... another way to block the connection is to add a 'tls-verify' script and to blacklist the full certificate name in that script.

I'm not an expert. I'm just a beginner. I thought that 'tls-verify' verifies white-list only. How to make a blacklist verification?

if the 'tls-verify' script returns a non-zero exit code the client is rejected. therefore, if your 'tls-verify' script does something like [code] #!/bin/bash [ $# -lt 2 ] && exit 1 # if the depth is non-zero , continue processing [ "$1" -ne 0 ] && exit 0 blacklisted_cns=`sed 's/ /_/g' /etc/openvpn/blacklist` for i in $blacklisted_cns do [ "$2" = "$i" ] && exit 1 done # catch-all exit 0 [/code] then you're blacklisting all certificate names listed in /etc/openvpn/blacklist.

i think user pol uses windows, script that janjust provided (and he should be thanked for that) is linux based script... pol did you consider using linux for your server? ;) Michael.

nice catch, Michael ;) did you really want me to write a Windows batch file :mrgreen: [code]@echo off if %1 neq 0 goto allow find %2 blacklist.txt > nul: if errorlevel 1 goto allow echo Access denied for %2 if ERRORLEVEL 0 exit /b 1 :allow rem entry not found in blacklist, return echo Access granted for %2 [/code] Use as follows: [code]check.bat 0 "/full-cert-DN"[/code] (remember to add quotes!)

Hi No, I'm using Windows only to generate certificates. I've got Liksys WRT54GL and Asus RT-N16 with Tomato based on Linux. Config file server.ovpn now contains: [quote]crl-verify /tmp/crl.pem tls-verify /tmp/blacklist.sh[/quote] I've made a file [b]/tmp/blacklist.sh[/b] with +x attribute ([i]chmod +x /tmp/blacklist.sh[/i]) [quote]#!/bin/bash [ $# -lt 2 ] && exit 1 # if the depth is non-zero, continue processing [ "$1" -ne 0 ] && exit 0 blacklisted_cns=`sed 's/ /_/g' /tmp/blacklist.txt` for i in $blacklisted_cns do [ "$2" = "$i" ] && exit 1 done # catch-all exit 0[/quote] And text file [b]/tmp/blacklist.txt[/b]: [quote]SzlendakM[/quote] I don't know what is the problem. I can't connect on any certificate. OpenVPN window everytime returns: [quote]read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)[/quote] What is wrong?

long live janjust! :mrgreen: :mrgreen: :mrgreen:

How to revoke cert with "ERROR:name does not match" (2)

pol

OK. After changes:

root@RT-BCAEC5C3CF5A:/tmp# cat blacklist.sh
#!/bin/sh

echo "argv=[$@]"
[ $# -lt 2 ] && exit 1

# if the depth is non-zero, continue processing
[ "$1" -ne 0 ] && exit 0

echo "DN=[$2]"
blacklisted_cns=`sed 's/ /_/g' /tmp/blacklist.txt`
for i in $blacklisted_cns
do
  echo "  [$i]"
  [ "$2" = "$i" ] && exit 1
done

# catch-all
exit 0

root@RT-BCAEC5C3CF5A:/tmp# /tmp/blacklist.sh 0 "/C=PL/ST=Podlaskie/O=*****/CN=Sz
lendakM/emailAddress=*****@*****.com.pl"
argv=[0 /C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl]
DN=[/C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl]
  [SzlendakM]
root@RT-BCAEC5C3CF5A:/tmp#

janjust

ah you only listed the /CN= part in the blacklist file ; the blacklist.sh script matches the full certificate DN, however.
Either list the full certificate DN in the blacklist.txt file, or do partial matching, e.g.

if echo "$2" | grep -q "$i" 
then
   exit 1
fi

pol

Oh, now I understand. OK, I've add full certificate DN and now it's working!
I'm so happy! Thank you (both) very much. I really appreciate it!

I will send you a beer if you want 😃

maikcat

I've add full certificate DN and now it's working!

good to know,

closing topic

regards

Michael.

« Previous Page