I am getting the following error in my openvpn log:
WARNING: Failed to stat CRL file, not (re)loading CRL.
Here are the relevant bits of my config:
crl-verify crl.pem
chroot /etc/openvpn/jail
user nobody
group nobody
The following command succeeds:
# sudo -u nobody -g nobody stat /etc/openvpn/jail/crl.pem
File: /etc/openvpn/jail/crl.pem
Size: 524 Blocks: 8 IO Block: 4096 regular file
Device: 803h/2051d Inode: 130387 Links: 1
Access: (0777/-rwxrwxrwx) Uid: (65534/ nobody) Gid: (65534/ nobody)
Access: 2020-04-08 17:14:06.000000000
Modify: 2020-04-08 16:50:02.000000000
Change: 2020-04-08 17:16:45.000000000
I have tried setting mode 0777 recursively on the jail directory but got the same results. If I put the file in /etc/openvpn/crl.pem, change the path to reflect this in the config, and remove the chroot option, I no longer see the error in the log. Any help with this would be greatly appreciated.
Version info:
# openvpn --version
OpenVPN 2.4.8 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb 7 2020
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push='no' enable_comp_stub='no' enable_crypto='yes' enable_crypto_ofb_cfb='yes' enable_debug='yes' enable_def_auth='yes' enable_dlopen='unknown' enable_dlopen_self='unknown' enable_dlopen_self_static='unknown' enable_fast_install='yes' enable_fragment='yes' enable_iproute2='yes' enable_libtool_lock='yes' enable_lz4='yes' enable_lzo='yes' enable_management='yes' enable_multihome='yes' enable_pam_dlopen='no' enable_pedantic='no' enable_pf='yes' enable_pkcs11='no' enable_plugin_auth_pam='yes' enable_plugin_down_root='yes' enable_plugins='yes' enable_port_share='yes' enable_selinux='no' enable_server='yes' enable_shared='yes' enable_shared_with_static_runtimes='no' enable_small='no' enable_static='yes' enable_strict='no' enable_strict_options='no' enable_systemd='no' enable_werror='no' enable_win32_dll='yes' enable_x509_alt_username='no' with_aix_soname='aix' with_crypto_library='openssl' with_gnu_ld='yes' with_mem_check='no' with_sysroot='no'
