How to add or remove Certifies [SOLVED]

GbMax78

I have install OpenVPN on my Debian Squeeze by reading this guide:
http://library.linode.com/networking/openvpn/debian-6-squeeze

After I have modify server.conf by reading this guide and my ip range:
http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
route 10.10.1.0 255.255.255.0
route 10.10.3.0 255.255.255.0
push "route 10.10.2.0 255.255.255.0"
push "route 10.10.1.0 255.255.255.0"
push "route 10.10.3.0 255.255.255.0"
client-to-client

Now I haven't understand how I can add and revoke clients certifies without a ./clean-all, I haven't find a right guide about it !

GbMax78

GbMax78

I have find this solution:
http://forums.openvpn.net/topic8243.html

I will try it, I think it work for add and revoke... or not ?

GbMax78

janjust

just follow the HOWTO on the openvpn website: http://openvpn.net/index.php/open-source/documentation/howto.html#pki

that explains it pretty well; why people bother with the Debian install guides beats me 😉

GbMax78

Thank you for the fast reply ! 😃

I solved for a new client but I haven't undertand how is the safe and right way to remove client;
I have try the follow:

root@server01:/etc/openvpn/easy-rsa/2.0# ./revoke-full client01
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
unable to load certificate
5786:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
unable to load certificate
5789:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
root@server01:/etc/openvpn/easy-rsa/2.0#

I can rm client01.key etc., I can delete in the index.txt the first line (this is the client01) but I don't kow if it is right...

GbMax78

janjust

did you run

. ./vars
./revoke-full client01

? where does $KEY_DIR point to ? what is listed in the file $KEY_DIR/index.txt ?

deleting the index.txt file is NOT a good thing to do - this is the primary 'database' file for the easy-rsa PKI system.

GbMax78

janjust wrotedid you run

. ./vars
./revoke-full client01

root@server01:/etc/openvpn/easy-rsa/2.0# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
root@server01:/etc/openvpn/easy-rsa/2.0# ./revoke-full client01
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
unable to load certificate
11437:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
unable to load certificate
11440:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
root@server01:/etc/openvpn/easy-rsa/2.0#

? where does $KEY_DIR point to ? what is listed in the file $KEY_DIR/index.txt ?

I haven't understand what do you mean about "where does $KEY_DIR point to ?" Key dir is a dir, doesn't point... in the index.txt I have three certifies and I Need to delete only the first !
For me the reason about client01 problems is the bad creation... for second and third certifies I have change commands and they work well !

deleting the index.txt file is NOT a good thing to do - this is the primary 'database' file for the easy-rsa PKI system.

Ok, we have the same think about ! 🙂

janjust

it seems the file 'client01.crt' has gone missing; if the file $KEY_DIR/01.pem is still there then you can copy that to 'client01.crt' and try again.

I was/am curious about the value of the env var $KEY_DIR; what does

echo $KEY_DIR

report?

GbMax78

janjust wroteit seems the file 'client01.crt' has gone missing; if the file $KEY_DIR/01.pem is still there then you can copy that to 'client01.crt' and try again.

client01.crt was blank, I have do:
root@server01:/etc/openvpn/easy-rsa/2.0/keys# cp 01.pem client01.crt

After I have do:
root@server01:/etc/openvpn/easy-rsa/2.0# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
root@server01:/etc/openvpn/easy-rsa/2.0# ./revoke-full client01
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
Revoking Certificate 01.
Data Base Updated
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
client01.crt: /C=IT/ST=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
error 23 at 0 depth lookup:certificate revoked

On keys dir there is client01.crt/csr/key and 01.pem, why ?

janjust wrote I was/am curious about the value of the env var $KEY_DIR; what does

echo $KEY_DIR

report?

root@server01:/etc/openvpn/easy-rsa/2.0/keys# echo keys
keys
root@server01:/etc/openvpn/easy-rsa/2.0/keys#

GbMax78

janjust

OK, this time the client1.crt file was revoked and a new CRL was created; if you add this CRL to your server configuration using
crl-verify <full-path-to-crl-file>
then the certificate is no longer accepted by the OpenVPN server.

the files are still there (client1.{crt,csr,key} and 01.pem) but the certificate is no longer accepted. If you want to completely get rid of the certificate (and you have not installed it anywhere) then it might be easier to start from scratch again.

GbMax78

janjust wroteOK, this time the client1.crt file was revoked and a new CRL was created; if you add this CRL to your server configuration using
crl-verify <full-path-to-crl-file>
then the certificate is no longer accepted by the OpenVPN server.

crl-verify it isn't enabled http://www.imped.net/oss/misc/openvpn-2.0-howto-edit.html
"The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory. The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:

crl-verify crl.pem

Now all connecting clients will have their client certificates verified against the CRL, and any positive match will result in the connection being dropped."

Now i'm searching how to enable crl-verify...

the files are still there (client1.{crt,csr,key} and 01.pem) but the certificate is no longer accepted. If you want to completely get rid of the certificate (and you have not installed it anywhere) then it might be easier to start from scratch again.

I haven't understand what do you mean about "...start from scratch again" and I haven't understand if I can add a new user with the same name of a delete user.

GbMax78

janjust

I haven't understand what do you mean about "...start from scratch again"

if you have given out only a few certificates then you could delete all of them, including the ca.crt and ca.key file, and start afresh.

I haven't understand if I can add a new user with the same name of a delete user.

yes you can - a revoke certificate is revoked based on the name + the certificate serial number; you can create a new certificate with the exact same name, but the serial number will be different.