Hello. OpenVPN 2.5.0, on each client connection spits this into log: [code]WARNING: Failed to stat CRL file, not (re)loading CRL.[/code] Nothing wrong in the client-side log. After service restart says: [code]CRL: loaded 1 CRLs from file /etc/openvpn/clnt/easy-rsa/keys/crl.pem[/code] crl.pem is owned by root:root, permissions 644. How do I fix this? I suppose this warning says that if any certificates are revoke, I have to restart OpenVPN service to re-read crl.pem, which I would like to avoid. Thank you in advance. :)

[quote=TinCanTech post_id=96143 time=1607183079 user_id=37053] Are you running Openvpn in a chroot ? [/quote] No, I am not. I've read a post about a case with a chroot, but I am not doing that, my OpenVPN runs without chroot and there are not any other warnings and/or errors in log file. Also everything works fine, clients are connecting and working. Except this line in log file every time a client connects: [code]WARNING: Failed to stat CRL file, not (re)loading CRL.[/code] [quote=300000 post_id=96144 time=1607186253 user_id=19319] if you are still try hard to to get crl workings why dont put t inline so it is more convenient to use , just add this line into your server config and it should work out of for you copy of crl pem base 64 and place in here [/quote] But this is similar to the crl.pem file read at the service restart, even worse, I would need to put the contents each time manually. And the goal is to automate it.

Failed to stat CRL file, not (re)loading CRL.

Ohforf

Hello.

OpenVPN 2.5.0, on each client connection spits this into log:

WARNING: Failed to stat CRL file, not (re)loading CRL.

Nothing wrong in the client-side log.

After service restart says:

CRL: loaded 1 CRLs from file /etc/openvpn/clnt/easy-rsa/keys/crl.pem

crl.pem is owned by root:root, permissions 644.

How do I fix this? I suppose this warning says that if any certificates are revoke, I have to restart OpenVPN service to re-read crl.pem, which I would like to avoid.

Thank you in advance. 🙂

TinCanTech

Are you running Openvpn in a chroot ?

300000

if you are still try hard to to get crl workings why dont put t inline so it is more convenient to use , just add this line into your server config and it should work out of for you

<crl-verify>
copy of crl pem base 64 and place in here
</crl-verify>

TinCanTech

While inlining a CRL seems to be supported, this is a stupid idea because you will have to edit in a new CRL every time the old one expires. Which means you will have to restart your server if you revoke any certificates and when your CRL expires.

Ohforf

TinCanTech wrote Are you running Openvpn in a chroot ?

No, I am not.

I've read a post about a case with a chroot, but I am not doing that, my OpenVPN runs without chroot and there are not any other warnings and/or errors in log file. Also everything works fine, clients are connecting and working. Except this line in log file every time a client connects:

WARNING: Failed to stat CRL file, not (re)loading CRL.

300000 wrote if you are still try hard to to get crl workings why dont put t inline so it is more convenient to use , just add this line into your server config and it should work out of for you

<crl-verify>
copy of crl pem base 64 and place in here
</crl-verify>

But this is similar to the crl.pem file read at the service restart, even worse, I would need to put the contents each time manually. And the goal is to automate it.

Ohforf

Any ideas please?

editedbaselin

I am having the same issue as the OP and would also appreciate any ideas. Again, no chroot, not keen on inline-ing, and so currently stuck with restarting the service.
Thanks

TinCanTech

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

StefanAu

Ohforf wrote Any ideas please?

What's about integrating with a RADIUS server?
This gives much more flexibility and you don't have to restart after every change...