Differences

This shows you the differences between two versions of the page.

--- pfsense:certificates:revoke_certificate [2021/02/18 18:40] – [Check the user certificate is revoked] peter
+++ pfsense:certificates:revoke_certificate [2021/02/19 10:08] (current) – [Checking the logs] peter
@@ Line 97: / Line 97: @@
+<WRAP alert>
+**ALERT:**  Even though the certificate is showing as Revoked, this will __NOT__ disable the user from accessing the VPN!!!
+Even if the certificate is deleted from the from revocation list, but the certificate is still in the certificate database, the user will still be able to connect!
+The Revocation Lists has to be enabled and configured.  See next steps.
+</WRAP>
@@ Line 124: / Line 132: @@
 Try to connect using the VPN client.
+This should fails.
+==== Checking the logs ====
+Navigate to **Status -> System Logs -> OpenVPN**.
+<code>
+...
+Feb 19 09:46:24 	openvpn 	2000 	192.168.1.102:48212 VERIFY ERROR: depth=0, error=certificate revoked: C=JE, L=St. Helier, O=ShareWiz, CN=peter
+Feb 19 09:46:24 	openvpn 	2000 	192.168.1.102:48212 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
+Feb 19 09:46:24 	openvpn 	2000 	192.168.1.102:48212 TLS_ERROR: BIO read tls_read_plaintext error
+Feb 19 09:46:24 	openvpn 	2000 	192.168.1.102:48212 TLS Error: TLS object -> incoming plaintext read error
+Feb 19 09:46:24 	openvpn 	2000 	192.168.1.102:48212 TLS Error: TLS handshake failed
+Feb 19 09:47:01 	openvpn 	2000 	192.168.1.102:52702 VERIFY ERROR: depth=0, error=certificate revoked: C=JE, L=St. Helier, O=ShareWiz, CN=peter
+Feb 19 09:47:01 	openvpn 	2000 	192.168.1.102:52702 OpenSSL: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
+Feb 19 09:47:01 	openvpn 	2000 	192.168.1.102:52702 TLS_ERROR: BIO read tls_read_plaintext error
+Feb 19 09:47:01 	openvpn 	2000 	192.168.1.102:52702 TLS Error: TLS object -> incoming plaintext read error
+Feb 19 09:47:01 	openvpn 	2000 	192.168.1.102:52702 TLS Error: TLS handshake failed
+...
+</code>
+<WRAP info>
+**NOTE:** The log shows the certificate verification failed due to certificate revoked
+</WRAP>
 ----