5

How can I set default_crl_days for my OpenVPN CLR to infinite days?

I'm planning to issue certificates to employees and if an employee leaves the company I just revoke their certificate in my CLR.

However as the CLR has an expiration date this seems very inconvinient to regularly renew the CLR.

Is there a way to set it to inifinite days / never expiring?

Improve this question

1 Answer 1

Reset to default
3

The nextUpdate field (i.e. what you treat as expiration date) is a timestamp. There is no way to specify an infinite time but you can specify a time far far away. But note that if you set nextUpdate too far in the future you have to somehow guarantee that anybody checking the CRL is still using the latest one and not some old (but still valid) version which does not contain critical revocations.

Improve this answer
5
  • Thanks for answering. Does that mean this field is NOT the expiration date? So what if I set it to 1 day, do I need to manually recreate a new CRL every day? Is there any better solution e.g. autorenew CRL?
    – Zate
    Aug 11, 2017 at 9:11
  • @Zate: it is kind of expiration date. It specifies the time before the next update has to be issued and thus kind of expires the current CRL. As for automatically renewing certificates - openssl is a tool chain not a product, i.e. you can use it to automate CRL renewal. But, this is actually a different question from the original one and should not be asked in a comment.
    – Steffen Ullrich
    Aug 11, 2017 at 9:48
  • 1
    @SteffenUllrich - I'm curious about the point you make here re the risk of setting the nextUpdate date too far in the future. It's not at all clear to me how this could be leveraged in the case of OpenVPN. I've added it to the bottom of my question here: security.stackexchange.com/q/202983/81392
    – Jeremy Davis
    Feb 5, 2019 at 8:09
  • 1
    @JeremyDavis - I have the same concern, I am revoking a certificate in OpenVPN. I have customized the openssl.cnf configuration increasing the 30 days default to 3650 days, but what are the risks? Your linked question is not available any more.
    – Kar.ma
    Apr 7, 2020 at 8:05
  • @Kar.ma - FWIW the linked question has been deleted due to unanswered after 1 year. The question was re the specific attack vector if nextUpdate set far in the future. This somewhat related question helped me: security.stackexchange.com/q/194558/81392. I did consider leaving the default as 30 days and running a cron job to auto update and distribute the updated cert, but in the end I just settled on 1 year for convenience.
    – Jeremy Davis
    Apr 8, 2020 at 1:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .