2

I recently setup an OpenVPN server with easy-rsa and have questions about certificate revocation:

In the event that someone's private key gets compromised and I have to revoke the certificate with revoke-full, do I need to keep the revoked .crt/.csr/.key on the server?

I'm asking because I'm using the certificate owner's full name as the certificate name and was wondering how I would generate a new certificate with the same name if there is already a (revoked) certificate with that name.

1 Answer 1

1

No, easy-rsa does not require you to keep revoked certificates around. The only reason I can come up with to keep them is to have some sort of poor mans audit log.

Just make sure to revoke the certificate before you remove it, because easy-rsa (at least version 2, which I looked at) seems to require the .crt file to be present to revoke a certificate.

Also, if you're still in the process of setting up your pki, consider switching to easy-rsa 3. That is a complete rewrite, which adds a number of interesting features such as ECDSA support.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .