How Do I Revoke a Client Cert ?

[saytr79]

So i've been playing around with OpenVPN and have figured most things out but one of the last two things i've been trying to work out is how to revoke a cert ( client1.ovpn ) ?

I've tried to run the revoke command below per the "howto" on OpenVPN's site but no luck.

vars
revoke-full client1


I'm somewhat new to running scripts via "Custom Configuration" on my router so i'm pretty sure i'm doing something wrong.

Thoughts ? Thanks in advance.

 

[saytr79]

Anyone ? Thoughts ? Suggestions ?

 

[sinshiva]

this involves adding the key/cert pair to a CRL file. to do this may require storing the crl file on /jffs and adding a symlink to the new CRL via init-start script. check the openvpn howto's regarding the CRL file usage.

 

[octopus]

Anyone ? Thoughts ? Suggestions ?

https://openvpn.net/index.php/open-source/documentation/howto.html#revoke

 

[saytr79]

this involves adding the key/cert pair to a CRL file. to do this may require storing the crl file on /jffs and adding a symlink to the new CRL via init-start script. check the openvpn howto's regarding the CRL file usage.

I figured as much but wasnt clear on how to mount the jffs and create the crl. I had already went to the howto Octopus suggested above to get the script listed in my initial post but was at a loss on how to mount the storage on the router to run the script.

I will dig around a bit more now that i know i need to mount the jffs. Thanks Sinshiva.

 

[octopus]

I figured as much but wasnt clear on how to mount the jffs and create the crl. I had already went to the howto Octopus suggested above to get the script listed in my initial post but was at a loss on how to mount the storage on the router to run the script.

I will dig around a bit more now that i know i need to mount the jffs. Thanks Sinshiva.

You can put revoke cert in /mnt or /jffs

crl-verify /mnt/[B]rt-ac68u[/B]/openvpn/crl.pem
crl-verify /jffs/openvpn/crl.pem

This is an example. rt-ac68u is label on my usb

 

[saytr79]

You can put revoke cert in /mnt or /jffs

crl-verify /mnt/[B]rt-ac68u[/B]/openvpn/crl.pem
crl-verify /jffs/openvpn/crl.pem

This is an example. rt-ac68u is label on my usb

Thank you very much Octopus. I will play around with it when i get home.