Revoking OpenVPN keys

Jason.nix · 02-05-2024, 10:49 AM

Hello,
I want to use the ./revoke-full "Client_Name" command to revoke a key:
1- Suppose I have two clients with the same name (Jason). I have generated the keys for one and not for the other. Now I revoke Jason's keys and generate new keys again with Jason's name. Because new keys with the same name are generated, can the previous Jason connect to the server?

2- Is the following command enough to refresh the CRL lifetime?

Code:

./easyrsa gen-crl

Thank you.

MilesWeb · 02-06-2024, 12:59 AM

1. No, the previous Jason (with the revoked keys) cannot connect to the server that you are looking for. When verifying certificates, server always look for unique identifier, not just the name.
You can follow practice of using unique client names for each set of keys. This will have more clarity and simplified management.

2. And, yes the command is sufficient to refresh the CRL lifetime

Code:

./easyrsa gen-crl

Jason.nix · 02-07-2024, 06:34 AM

Quote:

Originally Posted by MilesWeb

1. No, the previous Jason (with the revoked keys) cannot connect to the server that you are looking for. When verifying certificates, server always look for unique identifier, not just the name.
You can follow practice of using unique client names for each set of keys. This will have more clarity and simplified management.

2. And, yes the command is sufficient to refresh the CRL lifetime

Code:

./easyrsa gen-crl

Hello,
Thank you so much for your reply.
What is the default CRL lifetime?

sundialsvcs · 02-07-2024, 01:01 PM

Every certificate has a unique serial number, and that is what is used to identify it for revocation.

The CRL file is itself encrypted and signed so it can't be replaced or tampered with. (Unlike, say, ssh's authorized.keys file.)

Jason.nix · 02-10-2024, 12:48 PM

Quote:

Originally Posted by sundialsvcs

Every certificate has a unique serial number, and that is what is used to identify it for revocation.

The CRL file is itself encrypted and signed so it can't be replaced or tampered with. (Unlike, say, ssh's authorized.keys file.)

Hello,
Thank you so much for your reply.
I mean, when I generate a client key with Easy-RSA, how many days does it expire?

sundialsvcs · 02-13-2024, 08:20 AM

I'm not looking at the manual, so I honestly don't know about "expiration dates." I've never had to think about that.