OpenVPN + wrong CRL shown - revoking Certs doesn't work in all cases

jimp

Is the CRL file it mentions empty (zero bytes) when it fails, or does it have something in it?

eskild

Yes, it seems to be 0 byte:

-rw–----- 1 root wheel 0 Jul 13 16:27 server1.crl-verify
-rw------- 1 root wheel 0 Jul 13 09:04 server2.crl-verify

BR,
//Eskild

jimp

That would be the problem then.

I thought I had committed a fix for that before, I'll have to look into it again. Might be a couple days though.

jimp

Try it with these changes:

https://github.com/bsdperimeter/pfsense/commit/2ce206b048e8496e84f732556219e18290c5481c

(Or wait for a snapshot that includes those changes)

eskild

Thanks jimp,
the CRL is no longer empty, and works as expected.

Nachtfalke

@eskild:

Thanks jimp,
the CRL is no longer empty, and works as expected.

Did you try this with a new created CRL which has no certificates revoked in it ? (You remember, creating CRL, revoke a cert, cancel the revocation and then testing?)

I am at home for some days now and it wouldn't be fine, if I crash my OpenVPN and could not access the machine anymore untill I am back at work ;-)

jimp

@Nachtfalke:

Did you try this with a new created CRL which has no certificates revoked in it ? (You remember, creating CRL, revoke a cert, cancel the revocation and then testing?)

I am at home for some days now and it wouldn't be fine, if I crash my OpenVPN and could not access the machine anymore untill I am back at work ;-)

I did, and the CRL is no longer empty even when it has no certificates in it.

Nachtfalke

Hi,

I am using amd64 snapshot from 15 july.

I know there were some fixes before this snapshot. I created a cert some days before this snapshot called "test". I revoked it with the according CRL and it worked. No I wanted to cancel the revocation and wanted to delete the Cert "test" from the according CRL. It couldn't be deleted. It still exists there if I am deleteing it from "certificates".

If I create a new cert with same CA and same CN called "test" it appears again and as revoked. Then I am still not able to delete this cert from the CRL.

Certs.jpg_thumb

CRL.jpg_thumb

jimp

So you click the "x" on the CRL view, and what happens? Nothing? An error? Something else?

Nachtfalke

There comes a question if I would like to delete the cert from the CRL. I click OK. Then the cert disappears from the list. If I click again on the "Certificate revocation" tab, then the cert is again in the crl.

No visible error message.

CRL.jpg_thumb

jimp

Should be OK now, I just pushed a fix.

Nachtfalke

Hi,

I did some tests with 2.0-RC3 (amd64) built on Thu Jul 28 05:40:09 EDT 2011.

Deleting revoked certs of a CRL is working now as expected.
Allow and deny access is working as it should. I tested it several times with revoking a cert and then deleting the revocation.

Thanks jimp!