Set expiration date for certifacte issued for PAM/local user

felixw

Hello,

I have a questions a bit similar to that one: https://forums.openvpn.net/topic20352.html

What I understand is about the life span of a users/clients certificate is the following:
When creating a clients private and public key using easy-rsa manually, I can set the parameter KEY_EXPIRE to determine when the public key(thus certificate) is valid.
If that day is passed a new certificate should be issued.

However, considering I am using PAM or local authentication, how can this be changed?
What I saw so far is: When a user logs into the client's web ui, in the background the two files seems to be generated. I can find it then in the certs.db-data base as well the user can download his/her client.ovpn files including his keys.
So my question: Is it possible to set the KEY_EXPIRE for this process, which seems to run somehow in the background?

Any help is highly appreciated!

Thank you very much

Felix

felixw

So far I could not find a solution here.

As a workaorund: Is it possible to configure the client connect web fronted, that it distributes the config file necessary for the client without the key? So users could only download the configuration file itself and the keys will be distributed otherwise?