I recently setup an OpenVPN server with easy-rsa and have questions about certificate revocation:

In the event that someone's private key gets compromised and I have to revoke the certificate with revoke-full, do I need to keep the revoked .crt/.csr/.key on the server?

I'm asking because I'm using the certificate owner's full name as the certificate name and was wondering how I would generate a new certificate with the same name if there is already a (revoked) certificate with that name.


No, easy-rsa does not require you to keep revoked certificates around. The only reason I can come up with to keep them is to have some sort of poor mans audit log.

Just make sure to revoke the certificate before you remove it, because easy-rsa (at least version 2, which I looked at) seems to require the .crt file to be present to revoke a certificate.

Also, if you're still in the process of setting up your pki, consider switching to easy-rsa 3. That is a complete rewrite, which adds a number of interesting features such as ECDSA support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.