OpenVPN + wrong CRL shown - revoking Certs doesn't work in all cases

eskild

I have also tested with an empty CRL today, and the OpenVPN entity stopped. I have not tested with entries in CRL.

Jul 13 16:27:15 openvpn[7903]: 192.168.123.68:1194 /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.102.1 192.168.102.2 init
Jul 13 16:27:15 openvpn[7903]: 192.168.123.68:1194 Exiting
Jul 13 16:27:15 openvpn[7903]: 192.168.123.68:1194 CRL: cannot read CRL from file /var/etc/openvpn/server1.crl-verify
Jul 13 16:27:15 openvpn[7903]: 192.168.123.68:1194 LZO compression initialized
Jul 13 16:27:15 openvpn[7903]: 192.168.123.68:1194 Re-using SSL/TLS context

2.0-RC3 (i386)
built on Tue Jul 12 21:45:04 EDT 2011

jimp

Is the CRL file it mentions empty (zero bytes) when it fails, or does it have something in it?

eskild

Yes, it seems to be 0 byte:

-rw–----- 1 root wheel 0 Jul 13 16:27 server1.crl-verify
-rw------- 1 root wheel 0 Jul 13 09:04 server2.crl-verify

BR,
//Eskild

jimp

That would be the problem then.

I thought I had committed a fix for that before, I'll have to look into it again. Might be a couple days though.

jimp

Try it with these changes:

https://github.com/bsdperimeter/pfsense/commit/2ce206b048e8496e84f732556219e18290c5481c

(Or wait for a snapshot that includes those changes)

eskild

Thanks jimp,
the CRL is no longer empty, and works as expected.

Nachtfalke

@eskild:

Thanks jimp,
the CRL is no longer empty, and works as expected.

Did you try this with a new created CRL which has no certificates revoked in it ? (You remember, creating CRL, revoke a cert, cancel the revocation and then testing?)

I am at home for some days now and it wouldn't be fine, if I crash my OpenVPN and could not access the machine anymore untill I am back at work ;-)

jimp

@Nachtfalke:

Did you try this with a new created CRL which has no certificates revoked in it ? (You remember, creating CRL, revoke a cert, cancel the revocation and then testing?)

I am at home for some days now and it wouldn't be fine, if I crash my OpenVPN and could not access the machine anymore untill I am back at work ;-)

I did, and the CRL is no longer empty even when it has no certificates in it.

Nachtfalke

Hi,

I am using amd64 snapshot from 15 july.

I know there were some fixes before this snapshot. I created a cert some days before this snapshot called "test". I revoked it with the according CRL and it worked. No I wanted to cancel the revocation and wanted to delete the Cert "test" from the according CRL. It couldn't be deleted. It still exists there if I am deleteing it from "certificates".

If I create a new cert with same CA and same CN called "test" it appears again and as revoked. Then I am still not able to delete this cert from the CRL.

Certs.jpg_thumb

CRL.jpg_thumb

jimp

So you click the "x" on the CRL view, and what happens? Nothing? An error? Something else?

Nachtfalke

There comes a question if I would like to delete the cert from the CRL. I click OK. Then the cert disappears from the list. If I click again on the "Certificate revocation" tab, then the cert is again in the crl.

No visible error message.

CRL.jpg_thumb

jimp

Should be OK now, I just pushed a fix.

Nachtfalke

Hi,

I did some tests with 2.0-RC3 (amd64) built on Thu Jul 28 05:40:09 EDT 2011.

Deleting revoked certs of a CRL is working now as expected.
Allow and deny access is working as it should. I tested it several times with revoking a cert and then deleting the revocation.

Thanks jimp!