Replacing crl.pem kills openvpn service

gkrystev

I have a strange problem while replacing the crl.pem file.

My OpenVPN server (2.2.1 running on CentOS6) is confiured to use CRL to verfy for revoked certificates, so when I need to revoke some certificate, I need to replace "crl-verify /etc/openvpn/crl.pem" file, which works fine. From OpenVPN documentation I read that there is no problem to replace the file while the service is running and this will not cause any problems. The new file will be read right away when a new user try to connect/authenticate to the VPN server.

But!
On one of the servers, new users are connected constantly. When I replace the file (for example, open with vim and replace the content there, then save the file), the openvpn services crashes right away!
From the log I can see that:
openvpn[30834]: office2/10.0.0.144:40375 CRL: cannot read CRL from file /etc/openvpn/crl.pem
openvpn[30834]: office2/10.0.0.144:40375 Exiting
The file is fine, it exist and has all needed read permissions (only that I changed the content)

After starting the openvpn service again, all works back to normal, with the new CRL and all of its revoked certificates.

One of my suspison is that while the new file was writen, the client "office2" try to connect, and at this same moment the file does not exist or something.

My question, is there any way to skip this error, that the file is missing or something, not to kill the service.
And also, how to procceed with the file change then, without to restart the service?

janjust

this is a known bug - if a client connect whilst the CRL is being updated (or is generally, corrupt) then openvpn QUITS. I'm not sure if this is addressed in the upcoming 2.3 release.
See https://community.openvpn.net/openvpn/ticket/83 for more details

gkrystev

Very bad 🙁
Thanks for the replay

Still, from changelog for 2.3 beta version I saw that --crl-verify option has a new feature (directory mode), which probably will solve my problem.
Will wait for stable release.