Doubts about revoking certificates

Daimroc

I read a small guide to revoke certificates, in essential the steps are:

1.- run revoke-all [my certificate]
2.- Copy/move the crl.pem fiel to the openvpn folder
3.- Check if the revoke is made (check in the index.txt file if in the first column appears "R")

My doubts is:

- If I lost my index.txt files, then the certificate can be used to connect to the VPN? I need to revoke all the certificates again? What is the the function of the index.txt file?
- The file crl.pem is created one for each revoke certificate or are only one? Is updated with all the revoked certificates?

Thanks.

maikcat

hi there,

f I lost my index.txt files, then the certificate can be used to connect to the VPN?

in your server config you are using crl.pem for checking which certs are revoked,
so the answer is no the revoked cert will NOT connect.

What is the the function of the index.txt file?

it would be better to read about more SSL/TLS works...
anyway the index.txt file is updated when you add/revoke certs and its NOT needed to be
in your openvpn server in order openvpn to work....

in fact index.txt along with serial & ca.key must be stored elsewere..

The file crl.pem is created one for each revoke certificate or are only one?

AFAIK crl.pem contains ALL revoked certs .

Michael.