New created certificates are revoked ?
-
We have virtual pfsense installation. Today I created new user certificate for new VPN user. Then I generated ovpn config and tried to connect to check if all works ok. But got client errors local/remote TLS keys are out of sync.
Then I look into openvpn log and found this: "VERIFY ERROR: depth=0, error=certificate revoked: CN=dla, C=RU, ST=FE, ..."
I double checked CRL and it is doesn't contain dla cert. Old certificates work without problem. But newly created allways throw error=certificate revoked. InUse column in certificate list doesn't contain "revoked" for new certificates.
How this can be fixed ?
-
Found. There was old certificates generated using easy-rsa before pfsense installation. And it was added to crl. New certificate was created with same serial and became revoked. I created new one and all works.
There is a bug in pfsense - it should check crl and show "revoked" for certs with revoked serial.