I am a newbie regarding openvpn and cannot find a way to properly revoke a client certificate. I need to work on the openvpn server only because the client is no more accessible.

I am running a openvpn server and a customer which owns a remote client disconnected it. I need to avoid them reconnecting (forever) because of security reasons: it is possible they tampered with the unit in the meantime.

The openvpn server has been installed eons ago and it looks like something is missing.

OpenVPN server disable and reenable clients does not work because /easy_rsa/vars is missing.

How to Revoke an SSL/TLS Certificate needs easyrsa that is also missing.

Is there something I can do to completely cut them out?

  • Remove their user configuration.
    – Seth
    Jan 8, 2018 at 11:39
  • From the openvpn server? I have only the remote client' s keys and the static address configured. You mean that if I remove the keys and restart the service, that's enough to avoid future connections? Is that so easy?
    – Alex Poca
    Jan 8, 2018 at 14:17
  • Setup a new client, make sure you can connect with it, remove the key afterwards and have a look?
    – Seth
    Jan 8, 2018 at 16:59
  • Sometimes the easier solution doesn't come to mind. Of course @Seth you are right. I was overthinking. Pls write your comment as answer, so I can upvote. Thank you.
    – Alex Poca
    Jan 8, 2018 at 20:31

1 Answer 1


Usually removing the client key should be sufficient for to deny access but there might be configurations where this is insufficient.

In order to easily test it you could create a new client and make sure you can connect with it. Afterwards remove the key of the new client and try again to connect. If you're unable to my assumption would be that removing the key is sufficient.

In the long run you probably should spend some time to document the current system and dig into how it is setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .