Revoked certificate sill working

[deleted]

Hello all,
I have revoked my first certificate according to these instructions http://openvpn.net/index.php/open-source/documentation/howto.html#revoke
and the revoked certificate is is still working and allows connection to server.

This i what I've done:

cd /etc/openvpn/easy-rsa/2.0/
source ./vars
./revoke-full mycert
cp keys/crl.pem /etc/openvpn/
echo "crl-verify crl.pem" >> /etc/openvpn/server.conf
service openvpn restart

revoke-full has given me the error23 response which should indicate that the revocation has been successfull and the key is indeed revoked.

openssl crl -inform pem -text -noout -in crl.pem

contains a record about revoked certificate.

Am I doing something wrong that the revoked cert still works?

Please help me out with this.
Any advice is welcome.

maikcat

can you try using absolute path to your crl list?

Michael

[deleted]

maikcat wrotecan you try using absolute path to your crl list?

Thank you for quick response!
I have tried. Same behaviour. 🙁

maikcat

please post full server config & logs

Michael.

[deleted]

server.conf http://pastebin.com/Jwyukvwq
server.log http://pastebin.com/G0uJWN8n

# grep ^R index.txt
R       220819080942Z   130104072508Z   04      unknown XXX

# openssl crl -inform pem -text -noout -in ../../crl.pem 
Certificate Revocation List (CRL):
        Version 1 (0x0)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: XXX
        Last Update: Jan  4 07:25:08 2013 GMT
        Next Update: Feb  3 07:25:08 2013 GMT
Revoked Certificates:
    Serial Number: 04
        Revocation Date: Jan  4 07:25:08 2013 GMT
    Signature Algorithm: md5WithRSAEncryption
        XX:XX
#

I there anything else, that could help?

Thanks, Aas.

maikcat

server config

mode server
    dev tap
    local Server_External_IP
    port 1194
    proto udp
    ifconfig 192.168.2.254 255.255.255.0
    push "route 192.168.1.0 255.255.255.0 192.168.2.254"
    tls-server
    remote-cert-tls client
    auth-nocache
    dh keys/dh2048.pem
    ca keys/ca.crt
    cert keys/server.crt
    key keys/server.key
    crl-verify /etc/openvpn/crl.pem
    verb 3
    keepalive 10 120
    comp-lzo
    persist-key
    persist-tun
    user nobody
    group nobody
    client-to-client

use verb 4 and post full log here...

can you also post the output of:

openssl x509 -serial -noout -in yourcert.crt

Michael.

[deleted]

# openssl x509 -serial -noout -in mycert.crt
serial=04
#
# grep verb /etc/openvpn/server.conf
verb 4
# service openvpn restart
Restarting openvpn (via systemctl):                        [  OK   ]
#

output of server.log http://pastebin.com/WNiqHDxi
at Jan 22 08:43:42 begins connection attempt (and success) with mycert.crt

Thanks for assistance.
Aas.

maikcat

hi there,

there are some things that trouble me...

f.e i used your config and i saw that remote-cert-tls client triggers some messages like

Tue Jan 22 11:57:10 2013 192.168.122.102:1194 Validating certificate key usage
Tue Jan 22 11:57:10 2013 192.168.122.102:1194 ++ Certificate has key usage 0080, expects 0080
Tue Jan 22 11:57:10 2013 192.168.122.102:1194 VERIFY KU OK
Tue Jan 22 11:57:10 2013 192.168.122.102:1194 Validating certificate extended key usage
Tue Jan 22 11:57:10 2013 192.168.122.102:1194 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Tue Jan 22 11:57:10 2013 192.168.122.102:1194 VERIFY EKU OK

which doesnt appear to your logs at all....

what version are you using?
what OS are you using?

Michael.

[deleted]

It's OpenVPN 2.1.4 on Fedora 15.

Aas.

mwandelaar

aasami wroteIt's OpenVPN 2.1.4 on Fedora 15.

Allthough crl-checking should work with this version, maybe you can check if everything works with a more current version of openvpn. Because you are using fedora 15 (is it still supported? I don't know), you are probably also using an old openssl, which is the library checking the CRL and revocation.

Installing more recent versions in your OS is explained in: https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos but it from Fedora 16 and up.

jmilliron

You ever fix this aasami? I'm having what sounds like the same issue. Users are able to connect on revoked certs.

OpenVPN 2.2.1
Ubuntu precise (12.04.4 LTS)

[deleted]

jmilliron wroteYou ever fix this aasami? I'm having what sounds like the same issue. Users are able to connect on revoked certs.

OpenVPN 2.2.1
Ubuntu precise (12.04.4 LTS)

No. I haven't found a solution yet. :-(
I gave up shortly after.
If you manage to resolve this I would be glad to know.

Aas.