OpenVPN Certs



  • Hi guys,

    Just a quick question. After I revoke a certificate for OpenVPN or after a certificate has expired I am free to hit the delete button correct?

    We have run into some issues in the past and I just want to confirm this.

    Thanks!



  • No, you must not delete revoked certificates from the server!
    If you delete a cert it doesn't be count as revoked and will be accepted by the server since it fits to the servers CA.

    Expired certs will not be accepted anyway.



  • Then whats the best way to prevent the list from getting clogged up and very long?



  • The best way I can think of is that you create the certificates with short enough lifetimes so that regardless of you messing up the CRL the damage is minimized. What is short enough depends, it could be a year or two or longer in some cases.



  • You can delete them once they're expired or revoked. Might want to only delete the expired certs just in case the CRL gets messed up at some point so it's easy to add them back to the CRL/to a new CRL. Of course could always restore from backup as well in that case.