openvpn server.crt has expired

Hi there,

First, I would recommend confirming what actually expired, because OpenVPN setups often hit either the server cert or the CRL:

• Check server cert expiry: openssl x509 -in /etc/openvpn/server.crt -noout -dates

• Check CRL expiry (if you use crl-verify in the config): openssl crl -in /etc/openvpn/crl.pem -noout -nextupdate

If it is the server certificate, you generally need to issue a new server cert from the same CA. Depending on your Easy-RSA version, that is either a renew command (if supported) or re-issuing a fresh server.crt and server.key, then restarting OpenVPN.

If the CA itself is expired, you are usually looking at reissuing server and client certs.

Check out the DigitalOcean guide for the Ubuntu 18.04 setup: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-18-04

Heya, @tecnicogenny

If you used Easy-RSA on the server, go to your Easy-RSA directory and run:

cd /etc/openvpn/easy-rsa
sudo ./easyrsa renew server

If renew is not available, you can re-create it (still safe if signed by the same CA):

sudo ./easyrsa build-server-full server nopass

Then copy the new certificate and restart OpenVPN:

sudo cp pki/issued/server.crt /etc/openvpn/server.crt
sudo cp pki/private/server.key /etc/openvpn/server.key
sudo systemctl restart openvpn@server

Clients do not need changes as long as the CA is the same.

If you don’t have the CA/Easy-RSA files on this server, tell me and I’ll explain how to regenerate it from the CA machine.

Regards