Hi,
I need to set up a CA and an OpenVPN server where certificates may be revoked using a CRL file.
I am confused about the nextUpdate field of the CRL file and about OpenVPN configuration.
What is a good value for this nextUpdate field, how should the CA behave with respect to updating the CRL file, and what configuration of the OpenVPN server is required to make this work?
If I set the nextUpdate to a value far in the future, will OpenVPN ignore any updates to the CRL file until that date?
If I set a nextUpdate date shortly in the future, will OpenVPN after that date ignore the entries and allow clients to connect again?
The documentation at
https://openvpn.net/index.php/open-source/documentation/howto.html#revoke
https://openvpn.net/index.php/open-source/documentation/howto.html#config
https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN
does not seem to mention any of this, is there another place where I should look?
From these issues:
https://community.openvpn.net/openvpn/ticket/623
https://community.openvpn.net/openvpn/ticket/522
I believe that under normal circumstances, OpenVPN reloads the CRL on every new connection by a client, so setting the CRL validity period to something very long (a year) should not cause any problem, is that true?
