Hi
We are successfully using a openvpn server with TLS authentication. Accepted client certificates are either from CA 1 or from CA 2. For CRL checking with use
capath /etc/openvpn/ca
option pointing to a directory with the hash.suffix-style CRL files:
-rw-r--r-- 1 root root 1239 11. Aug 11:33 18321a6e.r0
-rw-r--r-- 1 root root 1585 11. Aug 15:12 79f1a304.r0
-rw-r--r-- 1 root root 1012 10. Aug 13:12 0f1a85bc.r0
Recently we discovered, that a client even with a
REVOKED certificate can gain access, although the CRL file has been updated in the capath directory AND the certificate is listed in the CRL.
strace output indicates, that openvpn is looking for CRL files with other suffixes than .r0:
stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/18321a6e.r2", 0x7fff7a013b70) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/79f1a304.r2", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)
stat("/etc/openvpn/ca/0f1a85bc.r1", 0x7fff7a013b20) = -1 ENOENT (No such file or directory)
Why is openvpn looking for r1 and r2 suffixes? Is this a known feature and how can I predict the name of the CRL file suffix? We think that this is a security issue that needs to be fixed.
Any ideas and comments are highly appreciated
Sven
server.conf (obfuscated)
mode server
tls-server
topology subnet
port 1194
proto udp
dev tun
capath /etc/openvpn/ca
cert ca/openvpn.crt
key ca/openvpn.key
dh ca/dh2048.pem
server 10.X.X.X 255.255.255.0
client-config-dir ccd
ccd-exclusive
keepalive 10 120
user nobody
group nobody
persist-key
persist-tun
status /data/openvpn/log/openvpn-status.log
log-append /data/openvpn/log/openvpn.log
verb 3
no-name-remapping
