Elegant solution for renewing CRL

[westbywest]

For openvpn-2.4.3 under Redhat7, the openssl.cnf supplied to easy-rsa sneaks in a default 30day expiration for the CRL:
default_crl_days= 30

Since this module doesn't provide direct management of openssl.cnf, VPN clients will fail to connect after 30days per the likely unexpected default. A crude resolution is to delete crl.pem and run puppet again to regenerate. Even more crude is to set openvpn::server::crl_verify = false.

Should this module take a more active role in managing crl.pem freshness? I.e. parametrize default_crl_days, and/or toggle the option to delete / regenerate crl.pem?

[bsnape]

Thanks @westbywest this is affecting me too. I hope that this module can fix the problem.

Setting crl_verify to true is very risky indeed as revoked certificates will be allowed to connect.

To give people a bit more context on your excellent answer, you'll see this error in the system log:

VERIFY ERROR: depth=0, error=CRL has expired: C=GB, ST=London, L=London, O=X, CN=X, emailAddress=X

and openssl.cnf is found here:

/etc/openvpn/<server-name>/easy-rsa/openssl.cnf

Here's a useful writeup from a bug report.

Personally, I'll be setting default_crl_days to 3650 to match the value in default_days for now. I think your suggestion of a regeneration option is a much cleaner approach though.

[hertell]

With a simple date-check we could maybe regenerate the crl if needed..

echo $(( $(date -d "$(openssl crl -in ${etc_directory}/openvpn/${name}/crl.pem -text|grep -oP 'Next Update: *\K.*')" +%s) - $(date +%s) ))

Puppet is not my strongest field, so i have not yet managed to create an exec for this.

[westbywest]

@hertell Having the module push the CRL expiration date out to a parameter would help avoid a situation where the user may be unaware such an expiration date exists (i.e. independently of any $key_expire value they specify). Letting puppet silently regenerate the CRL in the background is one resolution, but not for situations where puppet is only run once upon machine deployment, or at least only run irregularly. Looks like changes are being tested to make a new parameter: to-kn@cb97a75

[caiohasouza]

+1

[to-kn]

i added a parameter for automatically renewing the crl-list (since not all systems can edit the default_crl_days) if you are interested, i can open a PR (see https://github.com/to-kn/puppet-openvpn/tree/add_crl_renewal)
i have running it in production since one month, without any issue.

[to-kn]

this issue is fixed by #256, @bastelfreak i think you can close this