CRL is not yet valid

opana

Faced the problem discussed here CRL has expired.

I reissued the CRL with a different expiration date and added it to the OVPN settings. Installed a patch. And everything worked.

But. If turn off and then turn on the server pfsense, then it is impossible to connect to the ovpn server with configured CRL.

TLS Error: TLS handshake failed
TLS Error: TLS object -> incoming plaintext read error
TLS_ERROR: BIO read tls_read_plaintext error
OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
VERIFY ERROR: depth=0, error=CRL is not yet valid: CN=

If restart the vpn service or the entire pfsense server, then the vpn clients are connected. The error appears only after a complete shutdown.

I did the check on the test server 2.6.0-RELEASE (amd64) in VirtualBox Virtual Machine.

I can't test it on real hardware. There CRL is temporarily disabled.

jimp

Sounds like maybe your system has a clock problem, like the time on the hypervisor host is way off.

At boot the VM would take the initial time from the hypervisor, later after boot it would eventually do a time sync and get a more accurate time. If the clock in the hypervisor was way ahead (e.g. set to UTC but VM clock is set to a local time zone) it could have a similar result to what you are seeing.

opana

@jimp Yes, that is right.

Thanks

It's strange that it didn't show up before. This VM is over a year old. It was constantly on/off.