Docker-openvpn: How to revoke a user

[Awatatah]

Hello, I do not see in the documentation on how to revoke a user. Can anyone give me guidance?

[justingshreve]

I'm just getting familiar with project and might be way off, but might be able to remove user keys here:

/var/lib/docker/volumes/ovpn-data/_data/pki/private/user.key
/var/lib/docker/volumes/ovpn-data/_data/pki/issued/user.crt
/var/lib/docker/volumes/ovpn-data/_data/pki/reqs/user.req

where ovpn-data is directory you initially specified for OVPN_DATA env

[pieterlange]

If you created the certificates with easyrsa you can revoke them using easyrsa:
easyrsa revoke <CN of user you want to revoke access for>

Generate the CRL again:
easyrsa gen-crl

Make sure your openvpn is started with the --crl-verify option. Because you probably did not have a CRL yet, this means you'll need to restart your openvpn container. After this CRL updates will get picked up automatically.

[pieterlange]

To be clear: deleting the files as suggested by @justingshreve does nothing, as the client would still connect with a valid PKI certificate.

[derks]

Concurring with @pieterlange, the following worked for me:

$ docker exec -it OPENVPN-CONTAINER easyrsa revoke MY-USER-CN

$ docker exec -it OPENVPN-CONTAINER easyrsa gen-crl

Also, restarting the OPENVPN-CONTAINER was required becuase the CRL did not exist prior. I think that the following would be a solid addition to the out-of-the-box funcitonality:

• Generate a CRL during initial setup
• Add documentation on the above (How To Revoke Users)

[kylemanna]

This is related to a bug discussed in #101 and fixed #251