If you’re using OpenVPN 2.4 or higher, there’s a changed behaviour within OpenVPN: expired certificate revocation lists will no longer be accepted by the server. A client will successfully connect, then disconnect. The log on the server will print something like:
VERIFY ERROR: depth=0, error=CRL has expired: C=US, ST=CA, L=Ubuntu, O=Org, CN=client1, emailAddress=mymail@example.org
OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
TLS_ERROR: BIO read tls_read_plaintext error
TLS Error: TLS object -> incoming plaintext read error
TLS Error: TLS handshake failed
Fatal TLS error (check_tls_errors_co), restarting
I startet /etc/openvpn/openvpn-server1/easy-rsa/revoke-full „dummy“ which gave an error but recreated the revocation list. Make sure to change „default_crl_days“ in your openssl configuration beforehand!
