Hello again, I am searching a way to revoke access to my VPN server. I tried it using this command: [code]openssl ca -config openssl.cnf -revoke keys/client1.crt -keyfile keys/ca.key -cert keys/ca.crt[/code] What I am trying to do, is, to revoke the cert for client1 without removing [i]ca.key[/i] and [i]ca.crt[/i] as those were already used by other clients. Using the above mentioned code, system replies: [quote]error on line 145 of config file 'openssl.cnf' 1995458656:error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:618:line 145[/quote] Any idea, what I did wrong? Kind regards //nephilim

Hello Nephilim, Here are the steps: 1. cd /etc/openvpn/easy-rsa 2. . ./vars 3. ./revoke-full user.crt 4. mv -v /etc/openvpn/easy-rsa/keys/crl.pem /etc/openvpn/ 5. cat /etc/openvpn/easy-rsa/keys/index.txt 6. Make sure you something like this: [b][color=#FF0000]R[/color][/b] 111111111117Z 111111111111Z 01 unknown/C=PH/ST=NCR/L=MC/O=Company/OU=IT/CN=user1/name=user1/emailAddress=user@company.com 7. vi /etc/openvpn/server.conf 8. Make sure you have this "crl-verify crl.pem" 9. Save and exit 10. Restart OpenVPN service Cheers, juanpablo

How to revoke a cert

nephilim75

Hello again,

I am searching a way to revoke access to my VPN server. I tried it using this command:

openssl ca -config openssl.cnf -revoke keys/client1.crt -keyfile keys/ca.key -cert keys/ca.crt

What I am trying to do, is, to revoke the cert for client1 without removing ca.key and ca.crt as those were already used by other clients.

Using the above mentioned code, system replies:

error on line 145 of config file 'openssl.cnf'
1995458656:error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:618:line 145

Any idea, what I did wrong?

Kind regards
//nephilim

TinCanTech

nephilim75 wroteWhat I am trying to do, is, to revoke the cert for client1 without removing ca.key and ca.crt

You need --crl-verify

juanpablo

Hello Nephilim,

Here are the steps:

1. cd /etc/openvpn/easy-rsa
2. . ./vars
3. ./revoke-full user.crt
4. mv -v /etc/openvpn/easy-rsa/keys/crl.pem /etc/openvpn/
5. cat /etc/openvpn/easy-rsa/keys/index.txt
6. Make sure you something like this: R 111111111117Z 111111111111Z 01 unknown/C=PH/ST=NCR/L=MC/O=Company/OU=IT/CN=user1/name=user1/emailAddress=user@company.com
7. vi /etc/openvpn/server.conf
8. Make sure you have this "crl-verify crl.pem"
9. Save and exit
10. Restart OpenVPN service

Cheers,
juanpablo