OpenVPN client self-sign cert, revoke on elsewhere

certificateopenvpnrevoked

I've got myself into a pretty messy situation:

  1. I generated a clients self-signed certificate on server A, with server A being the CA.
  2. I then copied the self-signed certificate (.crt, .key) to server B, which is also a CA by itself.
  3. I started using this self-signed certificate on server B and it worked, so I didn't think too much afterward.

Now, I need to revoke this self-signed certificate, however I cannot do it on server B (it complaints about "name does not match"). I've managed to revoke it on server A which signed it, but how can I let server B know that this certificate has indeed been revoked?

I tried to copy the revoked cert over to server B but it doesn't really work…

Platform:

  • server A: Ubuntu server 10.10, openssl version 0.9.8o
  • server B: CentOS 4.4, openssl version 0.9.7a

If there's anything else I can provide please let me know.

Hope my explanation makes sense, if not, please leave me a msg. Any help would be very much appreciated!

Best Answer

You must have copied the server and client certificates from A to B if the same client certs still work when authenticating to B. Is this not the case? If you only moved the client certs, and not the server cert, but you can still authenticate to B with client certs from A, then you must have the same CA on A and B.

You don't need to copy the revoked cert to B, you just need to add the cert to B's revocation list. Normally, as long as the server and client certs are signed by the same CA, authentication will proceed. Revocation works by adding entries to a text file. When you authenticate with a cert, OpenVPN will check your Certificate Revocation List (CRL) to see if the cert has been revoked. You're not making any changes to the actual cert.

Related Topic