Hello,
Does OpenVPN server support certificate revocation via CRL? I imported a CA and server certificate from Linux and added a CRL under /certificate/crl via URL, but revoked clients can still connect.
Thank you!
For CRL to work, crl-use should be enabled under /certificate settings and access to port 80 should be allowed
Thanks.
Now I created a new CA certificate with the options key-cert-sign, crl-sign.
From now on, Mikrotik dynamically creates an entry in /certificate/crl:
[admin@Router-LAN_01] > /certificate/crl/print
Flags: D - DYNAMIC
Columns: CERT, LAST-UPDATE, REVOKED, URL
# CERT LAST-UPDATE REVOKED URL
0 D ca.crt_0 2025-08-28 12:12:45 234 http://crl.dat/crl/2.crl
The client connects correctly if crl-use is disabled, but when enabling crl-use I get this error:
2025-09-02 09:23:52 ovpn,info <1.2.3.4>: disconnected <TLS error: ssl: crl not found for: "C=AR, S=SF, L=Rosario, O=Company.com, OU=ITI, CN=Company.com CA" (6)>
The CRL has been uploaded to the web server and is accessible via HTTP on port 80; the file 2.crl downloads correctly:
2025-09-02 09:43:13 certificate,debug start CRL update
2025-09-02 09:43:13 certificate,debug updating CRL: http://crl.dat/crl/2.crl
Also, the certificate ca.crt_0 is correctly referenced:
# CERT LAST-UPDATE REVOKED URL
0 D ca.crt_0 2025-08-28 12:12:45 234 http://crl.dat/crl/2.crl
2.crl has been generated with the same CA and validation is successful:
[root@server] # openssl crl -in 2.crl -noout -text -CAfile cert_export_ca.crt_0.crt
verify OK
Why does Mikrotik still report “crl not found” even though the CRL is accessible via HTTP, correctly references the CA, and verifies successfully with OpenSSL?
Any ideas or suggestions on this?