Panos answer was correct as of 5 years ago. So it deserves a thumbs up. However since then, what has happened is the vars directory has been moved / removed, the /usr/share/easy-rsa directory doesn't seem to be present anymore and the $KEY_CONFIG seems to either not be there or coupled to the vars directory, which as i say seems to no longer be there, at least in Ubuntu 21.10 (April 2022).
I found this script submitted into github, and it looked good to me, I ran it and it worked, it unrevoked my revoked certificate.
#!/bin/bash
set -e
keys_index_file="/etc/openvpn/server/easy-rsa/pki/index.txt"
linenumber="$(grep -n "/CN=$1"'$' $keys_index_file | cut -f1 -d: | head -1)"
fileline="$(grep -n "/CN=$1"'$' $keys_index_file | head -1)"
line="$(grep "/CN=$1"'$' $keys_index_file | head -1)"
columns_number="$(echo $line | awk -F' ' '{print NF;}')"
echo $columns_number
if [[ $columns_number -eq 6 ]] && [[ $line == R* ]]; then
column2="$(echo $fileline | awk '{print $2}')"
column4="$(echo $fileline | awk '{print $4}')"
column5="$(echo $fileline | awk '{print $5}')"
column6="$(echo $fileline | awk '{print $6}')"
echo -e "V\t$column2\t\t$column4\t$column5\t$column6" >> $keys_index_file
sed -i "${linenumber}d" $keys_index_file
cd /etc/openvpn/server/easy-rsa
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -f /etc/openvpn/server/crl.pem
cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:nogroup /etc/openvpn/server/crl.pem
echo "Certificate unrevoked successfully."
exit 0;
elif [[ $columns_number -eq 5 ]] && [[ $fileline == V* ]]; then
echo "Certificate is already unrevoked and active"
exit 0;
else
echo "Error; Key index file may be corrupted."
exit 1;
fi
To run the script, you provide it with the name of the vpn certificate that you've revoked. This will be as it appears in the index.txt file in the /etc/openvpn/server/easy-rsa/pki/ directory on the command line. So copy and paste this into a file, say unrevoke.sh then run:
chmod 777 unrevoke.sh
./unrevoke.sh <Openvpn-Cert-name>
Now, I understand the arguments for why you should not unrevoke certificates. But this was an emergency.
Let me explain the circumstances:
I'm a developer working for a startup. I'm not a network admin or a system admin so i'm not the best person to ask, but there's nobody else to ask at all, so the responsibility fell onto me.
Essentially what had happened is we needed to move a piece of remote and unsupervised equipment from one vpn to another. Despite all our testing on the new vpn we (by that i mean "I") overlooked the fact that the system would by default try to send everything via the vpn. Including streaming tens of gigabytes of data across a 4G connection.
Naturally after switching the system became totally unresponsive and we couldn't logon via either vpn connection (nor through teamviewer). After trying to work out why, i came to the conclusion that it was because it was trying to stream data through the internet back to itself and that would probably cost us thousands in bills.
To mitigate the situation while i thought about how to resolve the issue, i revoked the vpn certificate, so at least the bandwidth it's trying to use is just limited to connection attempts not huge data streams.
The command i used to revoke the vpn cert was:
openvpn-install.sh
This comes with the openvpn installation and it provides a way to revoke a given certificate.
In the middle of the night, i worked out that there's a way to push the from the openvpn server config more specific routing information to stop it streaming everything. So I did that, and i unrevoked the revoked openvpn certificate.
Sure enough, after about 20-30 minutes the remote equipment picked up the vpn changes and began to calm down enough so that i could log in and revert the VPN back to the old settings before we tried to switch it over and the system was recovered.
I'm not going to lose my job over this. But someone else in a different company might. Anyway, I just wanted to share with you my experience and insight into why you might want to unrevoke a vpn certificate.
