In several previous articles I described how to install and configure an OpenVPN server on a Raspberry Pi. Just recently, I found myself unable to connect from outside to my home VPN server because the certificates had expired. Unfortunately, there was nothing I could do remotely, and I had to wait until I got home to run the commands below to renew the certificates (sudo -E /opt/EasyRSA-v3.0.6/easyrsa gen-crl).
By default, OpenVPN systems use a CRL valid for 365 days, after which all the OpenVPN certificates configured in it stop working (they will no longer let you connect to the VPN from outside). To extend the validity of your certificates, I recommend running the following commands from the terminal (after connecting to your VPN server via SSH):
export EASYRSA_CERT_EXPIRE=3650 export EASYRSA_CRL_DAYS=3650 cd /etc/openvpn/ sudo -E /opt/EasyRSA-v3.0.6/easyrsa gen-crl sudo service openvpn restart
This extends the validity of your certificates to 3650 days (10 years!). Of course, you can replace 3650 with whatever number of days you prefer.
To check whether the operation was successful (look at the “Next Update” entry), run the following command:
sudo openssl crl -in /etc/openvpn/pki/crl.pem -text
Enjoy!
