Issuing a certificate for managing temporary network access.

mbitsa12

Hello
I'm new to the forum, although I've been using OpenVPN for several years now.
Recently I've been asked to issue a certificate with a pre-delimited life span, so as to let people access until, and not beyond, a date set.
If I got it right, a life span is generaly allowed by configuration, however it is "system-wide", that is the same life span specification is related to any certificate issued by the CA.
Can temporary certificates be generated that are specific to a given user? In fact, I know tha CRL do exist, but anyway they require an explicit action to get the certificate expiring.
Thanks, Marco

mbitsa12

Any answer please, could it be deemed as a new feature to be added in OpenVPN as a product, perhaps, thanks

Inviato dal mio E2363 utilizzando Tapatalk

Traffic

Read about EsayRSA:
https://openvpn.net/index.php/open-source/documentation/howto.html#pki

Use vars file to set lifespan of new cert ..

mbitsa12

Thank you for your reply.
However, editing the vars file lifespan ( EASYRSA_CERT_EXPIRE ) affects all the users and their certificates, as the vars file is read once at the time the CA is built. My question was regarding to setting a lifespan for a specific certificated related to a specific user, without rebuilding or altering the CA. At this point I think that such thing should be added to the list of wishes. Correct?
Thanks

Traffic

mbitsa12 wroteaffects all the users and their certificates, as the vars file is read once at the time the CA is built

You can edit the file and create one new client cert/key pair then undo the edits.

You want to create a certificate with a limited lifespan .. that is how you can do it.

mbitsa12

Glad to know it, I definitely assumed too much.
Thank you.